You list technical solutions, but I'm talking about organisational failure. What about using too simple password, posting passwords on some semi-public forum, u

You list technical solutions, but I'm talking about organisational failure. What about using too simple password, posting passwords on some semi-public forum, using the same password for several people, using the same account for several people and so on. In large organisations, the problems are always found in the organisation itself, seldom in whatever tech stack is used. That they used unpatched Windows installations is not the disease, it's a symptom of the disease. You can enthusiastically treat the symptoms and improve the condition of the patient, but unless you go to the root causes, the patient will find new ways to be ill and you can 't be there to band-aid everything, all the time.