Normally you are juggling a huge amount of security technical debt, massively under-resourced, the CFO under-funding IT and having no budget for innovation in the first place is part of what caused the problem.

The security world and the compliance world are changing daily, don't track each other, and your compliance drives costs, while security drives incidents.