I really think the IT security industry ought to be ashamed of itself.

See Pournelle's Iron Law of Bureaucracy.