The Elephant in the IT Security Room That No One's Talking About