Yes, which is why I said 'and also get employees to follow basic cybersecurity practices.'

If the problem is either company culture or human nature is in the way of implementing cybersecurity properly, and I can assure you that this is true, having managed cybersecurity policies at a large non profit for over a year...

...then the field of cybersecurity should actually be figuring out how to successfully mitigate or solve this issue, they should be focusing on far more than just esoteric techno buzzwords in their marketing, and you know, actually be capable of delivering 'security', the thing they claim to sell.

If that means pivoting to things like the imoportance of training employees, developing a security conscious company culture, holding seminars to convince execs and middle management to not have cybersecurity as an afterthought as well as what it actually takes to actually be secure... then the field of cybersecurity should do that.