The security industry has changed to keep up with the evolving threats. Technologies have matured, emerged, and converged.
Best practices have solidified, and new disciplines have been developed. But many end-user organizations have not kept up. Many are operating what were considered best-in-class systems a few years ago that are now inadequate.
Many organizations are even worse off.