Many in my area hedge coverages against what they estimate attackers might want because there simply isn't enough talent in the infosec sector. The policy always looks better than increasing headcount.