Well, since ultimately this involves codewords dancing around the "don't want to pay proper wage", America's companies should instead hand their security over to outsourcing firms like they do with everything else that is IT related?<p>What could go wrong? Make sure to diversify to China, Russia, Eastern Europe, Malaysia, Israel etc.<p>Oh does that sound like a bad idea? The fact is as soon as the main systems development is outsourced, you might as well have outsourced the security too.<p>Probably why most enterprise security is a bunch of people buying Cisco appliances and formulating checklists and policies and don't even know specific vulnerabilities or the safety degree of various algorithms.<p>And of course, their main job, making powerpoints for upper management and occupying seats/budget such that when leaks or failures occur upper management has plausible deniability.