I imagine getting any security best practices (as defined by the employee) implemented to be as much as a political challenge as it is technical. With that sai

I imagine getting any security best practices (as defined by the employee) implemented to be as much as a political challenge as it is technical. With that said, most technical people don't want to be politicians.