I would call Colonial Pipeline a _negligent victim_ like most other companies that found themselves in the same situation of being hacked and held for ransom. Negligence stems from the fact that they consider Cyber Security as part of IT sunk costs that they do everything to minimize. Until there are real consequences from personal career costs to CEOs all way to jail time nothing will change. All these security consultants are part of Cyber Security Theater to shift blame away from company leadership and limit the media blast radius.
Of course, but let's not pretend otherwise about other companies that have not yet found themselves in the same situation: qualified negligence has been the name of the game in both IT management and software development since at least the '90s.
