> I have always found it surprising how easy it is to get access to offices just by tagging along with folks
Yeah it's ridiculous. At my office we've got so many employees I don't recognise about 75% of 'em. Meanwhile, everyone holds open the card-scanned doors to the stairways or elevators. Barely anyone wears their badges visibly. Files are rarely locked away properly after office hours, most employees preferring to put the files in a cabinet without the hassle of locking it and taking the key home with them etc.
That's despite having various audits, certifications, annual training sessions on the do's and don'ts. Nobody really cares, even though we handle some ridiculously sensitive client data. And it's really one of those 'noone else does it either' things. I started out in a diligent team with a boss who insisted, later moved teams where nobody cares, and it affects you.