Just because a company is big, or even a government agency does not mean they have the skill. I've worked for both, and the real security expertise (when they bother) is usually brought in through consultants. The apathy around security in both the public and private sectors is astounding. I keep hearing that it's difficult to get right. It's not. It does take some up-front thought though (security is not a bolt-on/refactor thing, it needs to be built in from the start), and a LOT of work. I know because I've gone through it (
https://www.wittenburg.co.uk/Entry.aspx?id=a7aae391-9ac8-411...).