> And the breaches will still happen, because most of the compliance requirements will be in the nature of having to install antivirus on your Linux servers and

> And the breaches will still happen, because most of the compliance requirements will be in the nature of having to install antivirus on your Linux servers and mandating passwords to be changed often enough that everybody writes them on a sticky note on the side of their monitor and the password reset mechanism becomes "easy to use" with the obvious implications of that. I'll note that the whole password on a sticky note example is not ideal, but doesn't weaken such systems against what is likely the biggest risk they face: network systems being compromised remotely. This is of course not ideal, but a far cry better than not having such policies in place.