Underfunding in the sense that extremely preventable real world hacks and breaches happened, with loss of customer private data. And underfunding because those companies had documented IT asking to be allowed to do exactly things that would prevent the attack.

If you want proof that real world attack would be stopped by measure, then you will leave the system vulnerable to everything your internal people were not able to exploit.