https://www.pivotpointsecurity.com/the-2-types-of-organizations-that-fail-information-security-which-one-are-you/