I have the misfortune of working with a "security group" that has zero understanding of actual security other than "tool said thing bad". They are so low-temp IQ I will not be shocked if they are the direct cause of a breach in the company at some point.