This is so true. And big corporations push around smaller vendors to have so many compliances, insurance and other certifications in place, whereas larger vendors can get away with insane security and privacy lapses just because of legacy. Makes me mad.
