Security has a design problem. Our security programs are unusable, causing people to opt-out. Our security tools are unmanageable, leading to staffing shortages and shelfware. The result is not defensible. This session details a framework combining path finding and choice architecture. The industry needs to get people to follow secure practices, to opt in, to transform security. The solution is design.