Background: 25 years of information security in very big text companies, from IT to CISO. People deploy whatever they think is useful, do not maintain it and t

Background: 25 years of information security in very big text companies, from IT to CISO. People deploy whatever they think is useful, do not maintain it and then a vulnerability arises. Nobody knows where the implementations are. Business pressures for availability, but did not want to sign off that they accept their systems to be insecure. You have a weak CISO and disaster strikes. Reluctance to use cloud based systems because of a weird belief that local teams will do better. Politics and who-has-the-biggest-one contests. Lack of knowledge about what data actually matters in the company, and once it is known lack of will to invest in protecting it. When crisis strikes legal is everywhere and teams waste time with useless feedback. ISO certified companies where it is dangerous to sneeze because the whole system will fall apart. The whole ISO obsession is maddening. I have never seen a hacker hacking the certification to get in. Generally speaking, a burnout because of the blocks cybersecurity gets, until there is a hack and then it is all their fault. Finally, a small hack here and there helps to raise awareness. Ah, and dreadful asset management.