To add to this. In (old school) enterprise security measures seem to exist more for compliance and legal protection. Top management and especially shareholders care much more about being financially protected via some insurance or government action than technically safe(ish). See Equifax.