A few months ago, I was on a call with a mid‑sized financial services firm. They had a solid security team and capable engineers. Nothing about the organization suggested risk