I've spent some time working with governments (and private businesses to a lesser extent) where tech strategy is ultimately managed by someone who has absolutel

I've spent some time working with governments (and private businesses to a lesser extent) where tech strategy is ultimately managed by someone who has absolutely no understanding of technology. Leaders often have this "series of tubes" level understanding but still insist on actively directing or commenting on technical issues, like this guy. Anyway, my point is that there is really a lot of underlying professionalism among developers, security folks, administrators and other technology professionals. People are often being managed by those who only vaguely understand what they are managing, have no sense of security or even the basic underlying knowledge to have security explained to them. Although there are lots of breaches, we still generally have working and reasonably secure technology, and it's mostly due to the conscientiousness of the lower level people working on it, rather than anything explicit from the top.