I think I have some insight into this subject, due to some of the wide array of similar industries I've worked in or consulted for (not wind but oil, etc) and y

I think I have some insight into this subject, due to some of the wide array of similar industries I've worked in or consulted for (not wind but oil, etc) and you are very close with your question of budget constraints. It is more than budget constraints though. I have primarily determined that budget constraints, while a factor, are a side-effect issue of a more root cause. Namely, a lack of representation for the IT department to the decision makers, whether that be a board of directors, the C-levels, etc. The problem is two-fold. The first problem is the management types are failing to understand that they need that representation to help guard from issues like these. Instead they often see more people as in their way and extra salary costs, and I have seen a disturbing trend the past 10 years or so of straight up gutting IT departments, often replaced by half-assed msp type consultants and highly overworked t1 and t2s. Second, is that the kinds of people that should be filling that role, often don't want to or don't have the business background to do it properly. Over on /r/sysadmin, ask how many senior sysadmins don't even have a CTO or CIO to report to, and instead are reporting straight to a CEO or even to a CFO. Often, when a CTO is hired, they are too far on the MBA side to do the department justice, or they are simply too focused on trying to be a techy often spending too much of their time pretending to be a programmer or something similar. Many of the sysadmins spend an inordinate amount of their time either supporting the business and trying to keep up with industry movement, to the point they often are failing to bridge the business-political gap that exists. They often understand the issue, but fail to put in to upper-management in a way that convinces them, which often leads to resentment or apathy over time, not to mention increased burn-out. I think there is a lot of opportunity to fix these issues though. A good sysadmin who transitioned into an MBA style program and then attempted to take a CTO/CIO role could really shine. In general I feel like the role of CTO/CIO is ripe for a huge turnover of fresh blood able to push more radical changes needed to survive the future. Another potential solution is in IT workers forming some type of actually useful or powerful union. LOPSA just doesn't cut it. We have seen union busting in the past, but the IT workforce is in a huge position of power to get a real union going, and hopefully with mechanisms to protect from the degredation and devolution other union forces have endured. The bottom line is this, in the end, these problems are managements fault, and until management is punished monetarily, legally, or through some other mechanism, they will not change their ways. bonus: you would be surprised at how many IT departments don't even have a budget (IE aren't given the numbers, or not in a proper form, etc. They get told to make proposals and they either get rejected or approved. You can guess which happens more.) second bonus: excess proprietary black boxes and reliance on third-party support breeds contempt for security. Misconfigured or lazily configured crap because everyone is cutting corners.