[lolsal]

I agree whole-heartedly. I’ve wasted many hours in security committee meetings. But then a CVE was discovered and we were able to respond in minutes. Earned our compensation 10x over with that preparedness, even if a lot of being prepared looked like downtime.

[steve1977]

I‘m not sure if that’s the scenario OP describing.

In my experience, that would be a company that spends hours in security committee meetings and then fails to react appropriately in an actual emergency.