Sure, but you always have tradeoffs for implementation time, interface friction, etc. You need to scope things properly so people know how to prioritize them and, in my experience, infosec people are really bad at that. They're so ready to hype up whatever they found that they don't really care how it relates to the real world.