This is normal. All these companies claim be data driven, but when it comes down to it all of these decisions are based on feels. This applies just as much to t

This is normal. All these companies claim be data driven, but when it comes down to it all of these decisions are based on feels. This applies just as much to technical rules as it does business decisions from the CEO. For example, when I have gone through infosec reviews, and I asked the reviewer to justify some rule with data, they can't do it, because it's just some wacky scenario they dreamed up but have no clue how probable/improbable it actually is.