Well, just because nobody did it and it was hard to get started with it doesn't mean it can't be done. On top of that, sec requirements are often missing the po

Well, just because nobody did it and it was hard to get started with it doesn't mean it can't be done. On top of that, sec requirements are often missing the point entirely (i.e. "complex" passwords that rotate every 30 days -- people will just write them down and stick them on the monitor, on top of that, complexity requirements are 99% bs because they don't actually increase the entropy or security, both Troy Hunt and XKCD agree [it's on the internet so it must be true!]) Another thing is that this points to another issue; just because the "no"-department (old-style security / CISO) thinks something should be done in one way doesn't mean you just take it, if they have a wrong idea or if a policy doesn't do what it says it does, having a conversation might actually make things better. Same goes for taking on a job, if there are policies in place that prevent a good working environment, either the policies need to be updated or you might as well not take the job. (and yes, that is more often an option than you might think, at lest where I live -- I know that is purely anecdotal/N=1) Reasons not to change or not to make things better are easy to find, it's the solutions that are hard.