[pid-1]

Most security controls used in your average business can be bypassed by knowledgeable users with enough time.

The aim is to make things as hard as reasonably possible so you can tell your boss and regulators that you did your part.

[mschuster91]

The problem is, most organizations - particularly large ones, but following the advent of "cyber insurances" also more and more smaller ones - drown in byzantine bureaucracy and requirements that makes work excessively difficult.

Any organization depends on people willing to bend, stretch and bypass the rules where necessary - refusing to do so is considered to be a form of labor action [1].

[1] https://en.wikipedia.org/wiki/Work-to-rule