Your statement described my hell. I put a lot of effort into running environments securely, and eventually, someone always decides to get a second opinion. Th

Your statement described my hell. I put a lot of effort into running environments securely, and eventually, someone always decides to get a second opinion. The only recommendation I have ever seen come from a security audit in an enterprise, is bikeshedding password lifetimes. Every time I point out "SQL Injection in the logon form" level vulnerabilities, I get directed to the "security experts", which is why I've seen password policies go from 180 days, to 90, to 30, while the mentioned issues get ignored. People flash a PWC business card and it's seen as credential. Then they drag me to the comms room and spend all day auditing the serial numbers on individual patch leads going to desktops.