Interesting.

They've gone from "no risk" to "low percentage of risk":

The president is getting his daily intelligence briefing on an iPad. Ten years ago we wouldn’t have done that, but that’s what the president wants, so that’s what he gets. Now, that iPad is neutered—it has no connectivity. It gets plugged into a docking station. We can do that for the president, but can we can’t scale that. So the question is, can we use commercial products that are secure?

Everything is about tradeoffs:

Interestingly, Levine described an agency that is being forced to adopt a more realistic and practical attitude toward risk. “It used to be that the NSA squeezed all risk out of everything,” he said. Even lower-levels of sensitivity were covered by Top Secret-level crypto. “We don’t do that now—it’s levels of risk. We say we can give you this, but can ensure only this level of risk.” Partly this came about, he suggested, because the military has an inherent understanding that nothing is without risk, and is used to seeing things in terms of tradeoffs: “With the military, everything is a risk decision. If this is the communications capability I need, I’ll have to take that risk.”

Funny that it was CIA that always seemed more comfortable with that kind of tradeoff.

Don't they have to be, by definition?

I mean, I think that's the reason the CIA exists in the first place.

To mitigate such tradeoffs.