It sounds like you’ve been working for Mom and pop shops then, and they’re not having audits done. Companies with millions of customers will usually either have in house secops or an mssp handle everything. Point being is, without audits then insurance usually will not be approved for PII loss or they flat out will not work with the company at all. It even more so with HIPAA laws.
I’m with the above commenter. I’ve worked at many companies of various sizes, from small local shops up to international corporations, including at least one contractor for the US military.
Every one of them had rules and policies and training on security, to varying degrees. But at every one of them, I’d find some vulnerability, or instance where someone was neglecting security. Each time, I’d bring it to the attention of someone in management. Each time (with one company as exception), those warnings would be “heard” and “passed up the chain”, and then nothing would happen. Only one company in 20 years of work actually fixed a security issue I found. And no company I’ve ever worked for was leak proof.
In my experience, until it threatens to cost a company much more money in losses than it would cost to fix the problem, but said problem will not get fixed. That’s profit motive. And often it seems they’d rather roll the dice until a loss occurs, and then (maybe) fix the issue.
It sounds like you’ve been working for Mom and pop shops then, and they’re not having audits done. Companies with millions of customers will usually either have in house secops or an mssp handle everything. Point being is, without audits then insurance usually will not be approved for PII loss or they flat out will not work with the company at all. It even more so with HIPAA laws.
I’m with the above commenter. I’ve worked at many companies of various sizes, from small local shops up to international corporations, including at least one contractor for the US military.
Every one of them had rules and policies and training on security, to varying degrees. But at every one of them, I’d find some vulnerability, or instance where someone was neglecting security. Each time, I’d bring it to the attention of someone in management. Each time (with one company as exception), those warnings would be “heard” and “passed up the chain”, and then nothing would happen. Only one company in 20 years of work actually fixed a security issue I found. And no company I’ve ever worked for was leak proof.
In my experience, until it threatens to cost a company much more money in losses than it would cost to fix the problem, but said problem will not get fixed. That’s profit motive. And often it seems they’d rather roll the dice until a loss occurs, and then (maybe) fix the issue.