Is this typical? 90+% of security "work" is seemingly pointless..

My manager sits in a lot of painful meetings telling people that they can’t do this or that as it goes against policy (policies which were made ages ago and have many questionable and even random elements). But the customer needs it, and so they submit an exception/change request, which goes through many reviews, meetings, discussions, everyone and their dog has an input, until eventually it comes back around to me to implement it anyway. Only now there’ll be a …

ages change customer cybersecurity manager people policies policy random request security work