Too often the focus is entirely on outside attacks, with little consideration given to insider attacks. Previous job was at a cyber security firm. We'd routinely come under attack from criminal and, we believed, occasional nation state attacks as our researchers attributed a few "Axis-of-Evil" nation-state operations.
Then you'd come back from lunch and find the mantrap doors propped open, or someone left a workstation unlocked with root access to something important, or random guests just wandering around. It's a miracle we never were compromised by a disgruntled employee (of which there were many).
New job, new industry, same behavior. Folks leaving "secure" doors open, workstations unlocked with root access, and all that jazz. They're happy to cite a vague SEC regulation that may have applied at their last job, but doesn't apply to ours and even then, it's not like an attacker would ever give a flying fuck about what the SEC thinks.
I'm starting to wonder if this isn't all a comically bad dream.
Maybe not the most technical solution to this, but one of my previous employers had a workplace culture of setting the desktop background to a rainbow with unicorns if someone left their computer unlocked. Sometimes even teams of two would work together to pwn some of the more alert members, by temporarily keeping them distracted while the other "attacker" did the business.
3 or more fails and the background bumped up to something pretty gross that nobody wanted, simply as a practical matter.
I actually thought gamifying it made it pretty fun, and at least for workstation locking, we were elite. Even today I'm sharp about it. Maybe it could be extended to physical access to areas as well.
On top of that, anything that relies on human discipline is going to fail. Everyone forgets sometims and an attacker only needs in once
Beginning with the simple workflow:
1. Get many burner phones for cash.
2. Get many prepaid credit card for cash.
3. Sign up for many self-driving car services.
4. Targeted denial of service.
(I'm avoiding the very-slow-cruise-missile scenario because nobody wants to think about it.)
It used to be really easy, but law enforcement is cracking down on the ability to buy and activate these anonymously for obvious reasons.
Are there ways around these? Sure, but it's not nearly as easy as you're proposing.
Most businesses who's primary money maker is not defense or security related... are not running their operation with a focus on defending themselves from themselves.