Most companies doesn't want to venture into employee training and reorientation for effective implementation of Cyber security in their firm.
Some blame it on finance which some said that it's irrelevant.
Maybe because none of their assets has been compromised in the past but this is not the yardstick to checking the likelihood of an actor by malicious actors.
Companies are busy with statics and company policy without looking into the Cyber effect of the company day to say activities.
Always thing outside the box when it cones to cyber space and the need to implement cyber security objectives towards effective management of company data and work force ..
Hakuna Matata ... Derek