Avoiding the Whac-a-Mole security response