Re: Being nasty to your own staff
Speaking as someone who works in security, I think it's likely the people who wrote that did not intend to be nasty and probably didn't even think that they were at the time. That doesn't speak well of them/us either, but it is different than the image you seem to have about their motivations or attitude.
I'm actually a lot more charitable towards the security tech folks here, because it's their job to find vulnerabilities, and they had found a doozy. One expects infosec folks to be adversarial. That's not the problem.
The problem is, having found that vulnerability doesn't mean that the proposed solutions that would be offered would be particularly useful:
1. Make the people who “failed” the test undergo more “training” — i.e., busywork. These people are overworked and nearing burnout. Making them stay back for a lesson that was basically “you should behave like you're not exhausted and harassed perpetually by insane workloads” is stupid, especially if it involves a 45-minute “training” session that the workers have to take in their own time on top of their insane workload.
2. Fire or subject them to disciplinary action. Congratulations, you've made it worse.
Again, the infosec people did nothing wrong here. They had found a social engineering loophole. Okay, it was one that anyone with eyes could see, but the solution for solving the problem was to make the people being exhausted and burned out not be burned out. And management doesn't want to do that. Anything but that. Won't anyone think of the rapacious neoliberals stripping public services to the bone stakeholders?
Like, two parties were getting fucked here — the workers, and the infosec professionals being thrown under the bus, when the blame should squarely be placed on management.