You're probably right. So far in my experience, that's pretty prevalent -- and the industry really does go out of its way to reward failure by rewarding heroics.

I read a bank security audit report once... it made me very concerned about banking in general. It was astonishing how many glaring security blunders these banks were making -- and this was pervasive, neither isolated nor limited to small banks...