That seems to match what I've seen. Especially the last line. It's just so weird the dynamic between "pretending to care" and "actually caring." I've worked

That seems to match what I've seen. Especially the last line. It's just so weird the dynamic between "pretending to care" and "actually caring." I've worked at or consulted on small teams that were very "lax" about security but everyone seemed to take it seriously so it "worked." At larger orgs, I notice they take it "seriously" but that results in people finding creative loopholes... like pasting in all the important production keys/passwords into a google doc and sharing the google doc because they "can't send secrets over slack" ... lol