Our IT guy warned us about a critical PHP vulnerability two years ago. He submitted a report explaining that hackers could potentially take over our servers. The CTO said there was no proof anyone could exploit it. Finance rejected the $12,000 security budget. We closed the ticket. Yesterday, researchers announced a critical PHP vulnerability. The CEO demanded to know why nobody saw it coming. Daniel from IT forwarded his original report. I immediately opened a disciplinary investigation. If Daniel knew about the vulnerability for two years, why did he allow the company to remain exposed for two years? He's now suspended without pay pending investigation. The CTO received a $25,000 crisis management bonus. We reward people who solve problems not predict them.