zlacker

There is not much to research. If companies want security, they should pay for security.

>>varisp+(OP)
> If companies want security, they should pay for security.

Or just properly follow best-practise, and their own procedures, internally.⁰

That was the failing here, which in an unusual act of honesty they are taking responsibility for in this matter.

--------

[0] That might be considered paying for security, indirectly, as it means having the resources available to make sure these things are done, and tracked so it can be proven they are done making slips difficult to happen and easy to track & hopefully rectify when they inevitably still do.

>>varisp+(OP)
Security is an arms race. Don't expect a leap; do your part to stay ahead.