Large institutions aren't solving their security problems by hiring a small clutch of FreeBSD elves. They're hiring consultants to confirm that they've met the

Large institutions aren't solving their security problems by hiring a small clutch of FreeBSD elves. They're hiring consultants to confirm that they've met the requirements of some checklist, which requirements may include "have a plan to fix this obvious problem.... someday. You do? OK, then you're fine". That's much cheaper and is 100% management-class controlled.