> and security is hard. Security experts act like it's very trivial and basic to get a fully secure shop up and running if we simply do everything they say. Wh

> and security is hard. Security experts act like it's very trivial and basic to get a fully secure shop up and running if we simply do everything they say. When something fails, the security expert gets fired, and a new one comes on board who will inevitably call the old one "incompetent" and claim that super basic and trivial things were not being followed. Repeat ad infinitum. Some organizations/companies are more vulnerable than others, but I have yet to see one that cannot be compromised by a determined/patient adversary.