He isn't excusing it, he's making this point this is far more common, and if you looked at any of the fortune 100, in sure you will find the same or WORSE pract

He isn't excusing it, he's making this point this is far more common, and if you looked at any of the fortune 100, in sure you will find the same or WORSE practices. I agree with his assessment, I just wish it was otherwise. Many orgs are simply lucky they have not been actively targeted by a determined attacker - they would be lambs to the slaughter.