The problem is typically that the higher-ups in any given company want to nickel-and-dime their IT security, typically only reacting once a breach has taken place... with the constant cries of the security folks falling on deaf ears, yet they're also the first to be blamed for the security failures. [thumbdown] So don't point fingers at the security folks... they know it's an issue, but the executives would rather line their own pockets and show better profit margins to their investors.