Which is better - two attack vectors that can be mitigated by an expert, or one attack vector that can't be mitigated by anyone?