Your security team is either incompetent or made powerless themselves by unthinking compliance tick box people. And frankly I'd go with incompetent as they sho

Your security team is either incompetent or made powerless themselves by unthinking compliance tick box people. And frankly I'd go with incompetent as they should be able to make a risk argument that there is no risk! I have heard similar stories from other people I know. There is unfortunately for business an acute shortage of good security people. This works well for me of course, as I find myself in demand :)