I'm not sure they (or any other really high-risk security company) calculated the true cost of connecting their network to the internet at all. A really simple

I'm not sure they (or any other really high-risk security company) calculated the true cost of connecting their network to the internet at all. A really simple, effective way of protecting sensitive data is to say that the network that hosts it will have absolutely no path outside. Then give your employee another machine on the same desk which connects to the internet but is on a completely network. It's annoying at first, but it works pretty damned well.