IT: Boss, I have good news and bad news.
CTO: Give me the good news.
IT: We put in network intrusion detection, updated our anti-virus, deployed a strong new firewall, hired security consultants, and finished end-user security training.
CTO: Sounds good. What’s the bad news?
IT: The COO opened an attachment.