That would be useful, but won't solve the problem alone. It's highly likely there were any number of engineers in these companies fuming about poor practice, bu

That would be useful, but won't solve the problem alone. It's highly likely there were any number of engineers in these companies fuming about poor practice, but lacking management support to prioritise it. Look at how TalkTalk ignored a security researcher's warnings a year before incurring a major attack. They were also storing in plain-text, available to support staff, and came up with comments like "We're squeaky-clean on security". This is a PR response, not one from the engineers who know what's going wrong. https://paul.reviews/value-security-avoid-talktalk/ https://paul.reviews/value-security-avoid-talktalk/