Your statement described my hell.<p>I put a lot of effort into running environments securely, and eventually, someone always decides to get a second opinion.<p>The only recommendation I have ever seen come from a security audit in an enterprise, is bikeshedding password lifetimes. Every time I point out &quot;SQL Injection in the logon form&quot; level vulnerabilities, I get directed to the &quot;security experts&quot;, which is why I&#x27;ve seen password policies go from 180 days, to 90, to 30, while the mentioned issues get ignored.<p>People flash a PWC business card and it&#x27;s seen as credential. Then they drag me to the comms room and spend all day auditing the serial numbers on individual patch leads going to desktops.