To add to others points and your own which may not be as obvious to some but my background stems from the financial world and security has always been a problem, breach du jour. The way things are done now are nothing short of broken, PCI and more, and all the glue holding the shattered "window" panes together certainly doesn't lead to anything secure or even a "window" you can see through. I'm certain there are millions that will disagree, job security of course, but when one has maintained critical uptime services on M$ as long as I have one begins to question there must be a better way. Solve your own problems first I always say as I am currently architecting that path, the sixth time of my career actually but this occurrence is different entirely.