Sorry for the delay in my response,

but what i'm really saying is that for my money, real security is more important. For my company's money, as long as they have plausible deniability, AKA "we had a policy, but someone didn't follow it," all is well.

They want to be secure, but it costs too much. So, instead, they buy the illusion. To the shareholders, it looks just as good.