@pseudonym I can tell you from assessing environments from very small to very large, the ones that have the best policies and procedures built out (typically to meet some framework or regulations) do tend to have the most secure environments. And more importantly, they know where their weaknesses and gaps lie.