The hardest part of good infosec is you have to *want* it.

So many companies miss this for simple box ticking. your infosec needs to be a culture and a mindset.

Conversely Scandals like cloudflare get swept under the rug because no one wants to be told their foremost authority on security was asleep at the wheel. Cloudflare has had at least 3 big screwups related to quality control. Continuing to give them a pass is eroding the profession and information security as a whole.