I think the issue was testing. Many organizations don't do enough, or the bare minimum, which is already insufficient as it's in some controlled lab that does not mimic the real world.