> The problem is that companies don’t want to invest the time in good security because it’s less profitable. Or, they are old and decrepit. If the company runs

> The problem is that companies don’t want to invest the time in good security because it’s less profitable. Or, they are old and decrepit. If the company runs critical infrastructure, then peoples’ safety is at risk. Most of the time, it's that a non-technical decision maker decides to take a badly mis-calculated risk. "Bob in sales can't access the files he needs." "IT give him admin rights! Now! no... I don't even understand or care to understand that access control mumbo-jumbo you are talking about." A week later, "Hey, you know we just got bitlockered. Bob's laptop got virused, and because we gave him admin rights his machine encrypted all the things AND the backup server too."