But useradmin is boring
Fairly typical situation (which equally translates to the commercial sector), all the focus is on the sexy stuff with scant attention paid to the boring routine security practices. Cue much wringing or hands, statements that we will do better, maybe a few dismissals of junior staff and then a quiet return to BAU.