The article conflates "IT team" with "infosec" which misses the faulty dynamic. In many organizations the "IT/Ops" team is the one acting on behalf of stakehol

The article conflates "IT team" with "infosec" which misses the faulty dynamic. In many organizations the "IT/Ops" team is the one acting on behalf of stakeholders with competing interests. If the CISO and CEO both exert pressure on Ops the CEO will ofcourse have more leverage and force Ops hand. This is just an extra layer of indirection that shields those above from liability. Having Ops act as the arbitrar of these stakeholders is pure theatrics.