Their CISO literally acknowledged it and then they all continued ignoring it again. This isn't just bad process, this is a broken security organization.