Most people in companies are not IT people or IT security people. The ones raising concerns are often only heard, when it is too late. How often have I heard silly arguments against safer tech like: "The people are not IT people, they want something simple!"