50% company doesn't know or care, 50% the company knows and wants to implement security but the auditors are stuck in 2005 (PCI Compliance: unless you somehow documented clearly your 'mitigations' because you are NOT rotating your passwords, you fail somehow).