@zackwhittaker /o\ For getting on for a decade I was sole, or one of two people, security people at a "security firm" responsible for gargantuan amounts of (huge, systemically important / CNI type) customers' super-sensitive data. Naturally, the cobblers children go barefoot; couldn't open s cupboard without being buried under a cascade of dusty skeletons. It was one of those "all the responsibility, no authority to fix anything" scenarios. The stress levels, I realise in retrospect, were horrific. The people in the trenches ag that gir have my deep sympathies. (The CISO/CTO who should have known and, I guess, likely took the big bucks and crossed their fingers that the music wouldn't stop til they'd left? ...not so much.)