Average doesn’t mean secure