[liowkc]

That therotically should be done for all systems before they go live. But unfortunately for whatever reasons (maybe ego, maybe cost considerations), they rather not know until the systems are being hacked.