IMO, the key challenge to IT security is business justification. The costs are very explicit: it's a shit ton of work to enable SELinux, and 2factor auth isn't

IMO, the key challenge to IT security is business justification. The costs are very explicit: it's a shit ton of work to enable SELinux, and 2factor auth isn't free. Meanwhile the benefits are fairly nebulous: 2 factor auth doesn't prevent shellcode injection into imagemagick. The end result is you have a low probability of a huge impacts occurring, without enough data to suggest the distribution of low probabilities, or the nature or distribution of huge impacts. You're sort of selling tiger repellent rocks, and when the big event does happen, you now have to convince the executives the counterfactual that if you had the budget to implement X, Y and Z, the event would have been prevented. Meanwhile, the costs on team velocity are silently ignored. The best case scenarios here probably revolve around insurance. Compliance auditors can impose non-compliance fees, and giving security teams a direct financial consequence avoided to point to would help their budget justifications.