It's so often the guys that are at the top who are the exception to the rules that are the problem.
I knew some folks who worked military communications and they broke rules regularly because senior officers just didn't want to walk across the street to do something secure...
Have worked in places where juniors had to lock devices when on prem; only authorized hardware in the rooms. Yet, the danger was from sloppy O6+ not the O1/GS6 who would (ready&abel) carry the water.
The is a serious problem with folk with power and authority and somehow no responsibility.
That's across government, service and corporate.
> The is a serious problem with folk with power and authority and somehow no responsibility.
Or perhaps the fundamental problem is with people in general - perhaps people without power and authority follow rules only because they don't have the power and authority to ignore them.
In the 00's, DIA had episodes of career researchers watching porn from secured and monitored systems and then losing their jobs and clearances. One can only conclude they wanted to be fired or were really, really stupid.
I had a C-level guy who installed on his fresh notebook a FireFox extension from the wrong domain, it contained mailware - he missed the official link in Google and clicked on whatever scammer site to download the extension :-X