Oh I don't treat it like a secret. It's more that it's not known or understood by many users in how it actually affects the security posture of your organization.

It's one of those commonly overlooked things.