> Certainly, calling out poor security practices is a good thing, however this level of scrutiny is going to require a major shift in mentality for a large port

> Certainly, calling out poor security practices is a good thing, however this level of scrutiny is going to require a major shift in mentality for a large portion of the industry. That's the point. "A major shift in mentality for a large portion of the industry" is basically GDPR's success criteria.