Oh please. This entire comment chain is about how they do not demand highly certified systems. Literally the only substantial thing I mentioned is the thing the

Oh please. This entire comment chain is about how they do not demand highly certified systems. Literally the only substantial thing I mentioned is the thing they have not mandated or pushed to implement. The only secondary thing I mentioned is that they should use systems that are empirically determined to protect against well-funded attackers as that is the actual goal. I did not supply a number to that, but I usually use 10 M$ as a bare minimum since we have seen numerous financially motivated attacks coming in around that number already. So, a 20 person red-team with 1 year full-time must not be able to find any vulnerabilities in your system, then you meet that bar. Again, nobody does that either. So, the only two things that I said are not being done. Then you keep coming back to how their security teams need to focus on easier wins. Yes, they do, but even if they do them all they have still failed to reach the minimum bar. The goal is not "better" it is "adequate". Following all modern best practices and doing everything correctly still leaves you vulnerable to the now commonplace attacks by financially motivated professional criminals. Being unable to protect against the adversaries who are literally attacking you is the definition of inadequate. Technology is the limiting factor for adequate security deployments. No matter how good your processes are you are still screwed against competent adversaries. That is not to say that technology is the limiting factor for most companies. Most companies also have bad processes. No matter what technology they are given they will screw it up. But even if you do everything (within reason) right and achieve the maximum potential of what is achievable you still have a inadequate system. That is a untenable state of affairs. As to your random personal attacks. I design and develop actual high security systems in defense applications. People do frequently accuse me of not knowing what I am talking about because what I view as standard processes are what they view as impossible dreams. I do try to tamp it down to be generally applicable even to low security systems.