> The root problem seems to be that most businesses treat IT security as a cost center, rather than a value center.

I think it’s worse than that. It’s not just security that lacks investment, it’s the whole IT infrastructure.

Obviously the observations of one lowly employee can’t be generalised much, but creaky infrastructure seems too common.