I'm surrounded by "opsec experts" (or whatever their name is lately) that keep running daily checks for windows pwned machines, against our servers which are al

I'm surrounded by "opsec experts" (or whatever their name is lately) that keep running daily checks for windows pwned machines, against our servers which are all linux. Like 4000 tests a day, always returning green charts, looking great on weekly meetings I'm sure. They've demanded that we drop the WAF for them (WAF still irks me, it implies you don't know what you're running, but that's another day's topic), so that they can "better test our infrastructure". They're completely oblivious on how a buffer overflow would be executed, and I'm pretty sure they couldn't tell me what the difference is between http2 and http. I'm really saddened by the fact that this industry just barely runs from one breach to the next, pretending everything is fine, not understanding any of it and slapping on one-click solutions and pen-testing up the wazoo. For christ sakes I had to correct a report saying our data was stored in a "community", because it's a third party data centre they never heard of. I'm close to encourage my children not to get into the IT industry...