> It's theatre, so it won't help actual security. I would disagree, as we had a very good security program and when we went through ISO 27001, I would have to

> It's theatre, so it won't help actual security. I would disagree, as we had a very good security program and when we went through ISO 27001, I would have to say that it ended up measurably better. But if you don't have a security culture, then it will be theater. Dangerously so.