From the article linked above it seems like people at Sony were exploiting the security budget, they had eight managers for three analysts: ”documents leaked after the recent attack show the company had just 11 people assigned to its information security team: ‘Three information security analysts are overseen by three managers, three directors, one executive director and one senior-vice president.’”