A company must be secured as a whole, from the web application to the employees to the last window screw.