I've heard this sentiment repeated quite a bit by non-technical people who hover around the fringes of the security field (compliance officers and the like), th

I've heard this sentiment repeated quite a bit by non-technical people who hover around the fringes of the security field (compliance officers and the like), that noone actually cares and we're just checking off boxes. That's not fair for those of us who really do care. As someone in offensive security, I can assure you that there's a huge difference between forgetting to check off a box to pay lip service and leaving a critical server wide open to hackers. The former will simply bounce back until you check it, the latter might put your company in the news or even out of business.