Great point. + most of mgmt doesn’t see the real value in security until after the first (major) incident has occurred. (Has been my experience atleaste for < 50 employee orgs.)