The question of how to balance pragmatism with an absolutist view of security has been discussed here already. But I need the answer to a concrete variant of that question.
You're the security expert hired to help an application team with the security problems of their app. One of the members of the team takes the "good enough just isn't good enough" approach, and wants to implement the perfect security system. He's already decided that the platform the product will run on is fundamentally insecure, and will repeat this assertion when there's anyone listening (and even when they'd rather not). Any proposed mitigation strategy is not good enough. He's not interested in identifying and reducing risks to the activity supported by the product; he's interested in absolute security. Sneaky ways out of the problem like the fact that the project has a finite budget and finite expected revenue will not fly: it needs to be done completely or it isn't worth doing.
Unfortunately, this person has the ear of the senior management team, so appealing to authority is not going to work. The project has stalled because discussions of the security requirements are just spinning around with no resolution. How would you move things on?