Nothing I&#x27;ve worked on has been nearly to this scale, but having management understand and ignore warnings is commonplace.<p>Just today, I pointed out that a backend web service system for an important (HR) function was so insecure that simply putting a single quote in an end-user input field would crash it, and that a SQL injection would be trivial.  After a little arguing from them (&quot;You don&#x27;t know what a SQL injection is&quot;) they changed their tune to &quot;Just put a limit on the frontend&quot;, and when I told them that could be trivially bypassed, they said &quot;No one will ever think to try that.&quot;  When I pressed further, they continued to &quot;It&#x27;s an internal app, no one would attack it&quot; then to &quot;And do you want me to put locks on all the doors and cabinets around the office too?&quot;<p>So that&#x27;s a case where there&#x27;s some reasonable level of understanding and just a refusal to act.<p>I also recall a time (at a different company) when I discovered a public read&#x2F;write anonymous FTP server setup  externally facing with no firewall rules.  When I pointed out the problem, they said, &quot;that&#x27;s what our customers are used to, we&#x27;re not going to change it.&quot; and when I pushed, &quot;No one will ever find it anyways.&quot;  Literally less than a month later that server was overrun with illicit content.<p>It happens.  Unfortunately, as we&#x27;ve seen with the Volkswagen debacle as well, it happens even when regulation or (in the Challenger case) human life is on the line.