Sometimes it involves deliberately not telling folks how to protect themselves from accidental/deliberate exploitation of a security hole, because educating them would also mean educating potential attackers about the hole.

You can imagine how thrilled I am at the prospect.