@beyondmachines1 Unfortunately, there's also "who'll install a vendor solution which ticks various boxes but in actuality reduces overall security within the organisation?"

I've seen a lot of "install vendor X $$$$$ virtual platform solution which ticks off boxes A, B and C in our consultant supplied checklist of buzzword compliance" followed by "we don't have money to do basics such as setting up certificate management or enabling HTTPS on our website".