Either their CISO was shut out of the decision making, the SLT decided it was a risk worth taking, or their CISO was absolutely asleep at the wheel.