content: Not only that, try getting security paid for by most companies.  They are literally so short sighted that security is seen as a money sink with no value so rarely will invest the kind of money into security that would allow solutions that would work. User identity on network flows? Too expensive, Network Access Devices, too expensive, Update gear that is out of life, too expensive, what we have is working, etc.  In most companies, security is an afterthought and is only done to 'check a box'. Don't even get me started on corporate 'security experts'  who are really nothing more than paper-pushers that track audit activities and have no actual technology background nor understand the solutions needed.