It remains somewhat, ah, interesting that the biggest GDPR fine is for not being able to withstand a targeted attack by a motivated attacker. The British Airway

It remains somewhat, ah, interesting that the biggest GDPR fine is for not being able to withstand a targeted attack by a motivated attacker. The British Airways compromise seems to have involved someone getting access to their systems (which basically just requires one employee screwing up, once) and hiding malicious code in their website so custom-tailored to them that an uninvolved outside expert in the malware family involved had trouble ientifying where it was after he knew it was there due to the news coverage. That's the kind of "gross negligence" that leads to a record fine and I don't think IT security as it currently stands is even remotely capable of preventing it.