Probably not. Security is full of the "We're Compliant" types (don't we have insurance for that?) and very few real technologists who know how to hack/break/abu

Probably not. Security is full of the "We're Compliant" types (don't we have insurance for that?) and very few real technologists who know how to hack/break/abuse systems. Target was PCI compliant when their CC data was breached and exposed. There are many more examples of this. Check the box, get owned and no really cares. That needs to change.