A lot of folks that are hired for security are not all that suited for the job. The reality is there probably aren’t enough people out there that really are, so

A lot of folks that are hired for security are not all that suited for the job. The reality is there probably aren’t enough people out there that really are, so what you get is a lot of off the shelf security products stacked on top of one another to create security theater, but mostly just slow systems and processes down without actually doing much of anything. At the same time real vulnerabilities are left open because it would require some actual thought to fix.