How projection slows down the path to security maturity