A lot less often now that best practices are better understood, and people insist on public security audits.