Most organisations can list the IT security tools and controls they have, so why do most of them still get the security basics wrong?

https://www.computerweekly.com/opinion/Cyber-security-why-youre-doing-it-all-wrong