If you had unlimited resources (money, people, time) to fix security in your organization, what would you address? (in order of priority)

This is a question I often ask people at the end of interviews during my assessments.

People often have a list of things they want fixed. The problem is choosing which of those things to fix.

Two problems exist in securi…