Sadly, this is the state of security not just in companies but also public services. I know very well that unless there are large security breaches nothing changes. Even after that the staff on the ground hardly get listen too which results in little improvement. Not just in cybersecurity but other type of security. It’s scary and at times even depressing.
Thank you for your input @Maxcobos, very much approcated. 