It's very hard to get raises or promotions on all the bad things that would have happened, had your actions not entirely prevented them. Much better to devote t

It's very hard to get raises or promotions on all the bad things that would have happened, had your actions not entirely prevented them. Much better to devote those resources to new initiatives or "transformations" or whatever, ideally ones that can be tied directly to higher revenue, while doing just enough about security that you can't be accused of being unusually lax if something goes wrong (and since all your peers are very lax, for the same reasons, this isn't much).