Right, and that applies to probably all but a small percentage of organizations. Not malice, just management that doesn't properly account for the negatives in

Right, and that applies to probably all but a small percentage of organizations. Not malice, just management that doesn't properly account for the negatives involved in poor security policy. Banks are no exception to the rule that all the managers are humans, and may not have the best information / mindset. Fix the lowest hanging fruit as fast as possible, and raise the mean incrementally.