That seems to be the motto here where I work. Supposedly, we are audited by a partner but I amazed that we have not had a major breach of security yet. Default admin password on all the windows images used for desktops, no complex password requirement, passwords changed on a phone call with no challenge to the person's identity, and the list goes on. I have reported each thing I have found but no one responds, so I am officially just waiting to watch the train wreck at this point.