Reality check: Security (especially IT security) takes a back seat in 90% of businesses. The only exceptions are corps who gain significant power over govs and users by being secure (I think Google and Facebook here), and when regulations require a corp to do some kind of security fundamentals then these are applied as necessary to avoid fines.