Yep, AV vendors and various certifications and the security consultancy industry have created a "something must be done, this is somethign, thereferore it must

Yep, AV vendors and various certifications and the security consultancy industry have created a "something must be done, this is somethign, thereferore it must be done" situation profiting from security problems that feeds on orgs that have fallen into the pattern of uncritically doing what everyone else is doing in the industry.