Any blog posts that claims enterprises did any kind of meaningful security evaluation is a joke. They say almost nothing about fixing their existing shenanigans nor their past failures in that posting.