[d0ugie]

Perhaps fairly inevitable eventual breaches of client data are more forgivable when a given firm can point to efforts such as this as evidence of having tried to keep a lid on leaks, and to elevate confidence that it is less likely to happen.

From what I've seen some firms' internal security practices in general seem more to be about appearances whereas other firms tighten and scrutinize everything as if the company's reputation and survival depended on it.