It&#x27;s true.<p>I think we&#x27;re living in an era of systemic failure of risk analysis. I see it in my company too, where the InfoSec team is basically given free reign, and they&#x27;re not happy unless every machine is airgapped. At other companies, there is no concept of security at all.<p>Where is the department that makes the cost&#x2F;benefit analysis of security measures? I don&#x27;t see it in government, i don&#x27;t see it in the private sector.