It is sad that people using programms in an organization have no idea what those programms do. This is basic security practice.
But as someone said in another thread "security bugs are part of the lifecycle". With such an attitude, no wonder.
Next we need a statement from kernel.org that the kernel does not use log4j.