First, SSO is often non-negotiable. Otherwise employees spend a huge chunk of their working day just logging into different services.
Second, too complicated security setups often result in trivially hackable global passwords and shit like that because turns out, there are very few people willing to daily rotate and remember 30 different cryptographically random 256-bit arrays.
Third, no matter how robust your security setup is, there will always be someone who finds a flaw in it, so a much better solution is to just do bare minimum and get insurance.
It's strange to be that so many security experts are completely detached from how humans actually act.
Second, too complicated security setups often result in trivially hackable global passwords and shit like that because turns out, there are very few people willing to daily rotate and remember 30 different cryptographically random 256-bit arrays.
Third, no matter how robust your security setup is, there will always be someone who finds a flaw in it, so a much better solution is to just do bare minimum and get insurance.
It's strange to be that so many security experts are completely detached from how humans actually act.