I saw the same presentation. You're right, they could use a penetration team in the release development cycle. I was referring to the access control model that

I saw the same presentation. You're right, they could use a penetration team in the release development cycle. I was referring to the access control model that's built in to Mainframes. They were pioneers of mandatory access control's and fine grained security. Having fewer people working on them is a definite issue, though, when it comes to the kinds of exposures that Mainframe integration to a corporate environment entail.