Even if I have security certificates then 1000 other employees don’t have them. Regular people even don’t care about any security they just do their jobs. The

Even if I have security certificates then 1000 other employees don’t have them. Regular people even don’t care about any security they just do their jobs. There are also so many servers/applications/settings that you don’t have enough security aware employees to review everything. If you look long enough any company at some point will have something open that should not be. That is what hacker groups do - they constantly look for an opening. They find these because company as it operates has to setup new servers new configurations all the time it is not set once and done.