> I mean, there's very little you do about this particular scenario other than some small mitigations (at the end of the day you'll have to trust someone with s

> I mean, there's very little you do about this particular scenario other than some small mitigations (at the end of the day you'll have to trust someone with something) but it's genuinely amazing how vulnerable the processes inside large, multi-million companies are to any internal attacker. Maybe the scenario is too rare for companies to care, so when it happens they just accept the cost of once in a while instead of setting up additional security policies which will turn procedures cumbersome.