They’ve made some pretty impressive inroads on user profile security, specifically on company best practices to blow it off entirely