Just going for big shiny boxes makes me think they were “security experts” instead of security experts. There’s a difference. I think security experts would’ve put more effort into risk assessment and covering the basics.