Even if it's the latter, they're actually thinking about what they're trying to protect and what system would work best to protect it. That has got to be an improvement on the mindless, cargo-cult approach to security that most organizations take.