I’ve watched engineers lose a week before an audit collecting screenshots no one will ever look at again. I’ve seen incident response plans that exist on paper but have never been tested, and vendor questionnaires completed once and filed away while the risk quietly changed underneath them.
