I've found that very few companies in the third category understand that they are. As a result, they are unable to admit it and a security person only finds out

I've found that very few companies in the third category understand that they are. As a result, they are unable to admit it and a security person only finds out when a need to bid for resources arises. Then they learn that the company sincerely believed that hiring the security person is all the resources required.