And organisations fail at security when security and compliance is only considered important by that one teamnn

Security requires the whole business to buy in. And it requires processes that allow people to get shit done without people resorting to shadow IT; thus working around that one team.

So the GPs point still works.