>Young people and operational security doesn't exist.

If I had PII in the systems they have access to I would be concerned. How long until someone gets spear phished or malware is installed on their presumably non-compliant systems? There's a reason why big corps spend significantly on security training for new grads.