> You'd think you're hacking away and/or find vulnerabilities all the time, but in reality - at least in my experience -, you spend most of your times fixing th

> You'd think you're hacking away and/or find vulnerabilities all the time, but in reality - at least in my experience -, you spend most of your times fixing the easy stuff and selling the measures to both management and your users. As I see it, whatever technical measures are put in place people in the org will always need access to data at some level. With that in mind, it's about educating users so they know what's risky, what best practices are etc. Easier said than done of course!