> companies tend to rely on their employees’ vigilance

AKA they ignore the problem but check it off on the security audit.