Your suggestion is often equivalent to fixing one little bolt on a machine that has numerous more fundamental flaws. It might not be a bad idea in the abstract, but a company with an extremely hardened IT system is still vulnerable without an institutional culture trained and enforced to match.