> The 0.2% of people that do might actually be really good [2] but these consultancies don't tend to put their employees on improving the internal state of affa

> The 0.2% of people that do might actually be really good [2] but these consultancies don't tend to put their employees on improving the internal state of affairs. I think your percentages are off (over ~60% of the firm's revenue is now consulting, a large part digital), but this hits the nail on the head. On the external consulting side, I was regularly in fruitless heated argument with internal IT. As bad as it is, I think the recovery spin to clients (it's an important point and true) is the the engineers they are getting in a consulting capacity are completely separate to the people managing the laptops. I do think your second footnote is important too, these are totally separate companies. This is a Deloitte US breach, the IT systems are totally separate. The brand damage (the value of the information in the audit records if unreleased is astronomical) will be shared, but at least the scope of the actual leak will be limited to that member firm.