Wow, truly fantastic research Sarah.

It is sad yet tell-tale how many in-house IT teams around the world have such egos that they refuse to use "real" providers and expert consultants to secure their data and infrastructure.

On a daily basis, WordPress sites and other databases are breached at universities and companies around the world for this very reason.

Google Apps, for example, is free for most universities, and WordPress itself is very easy to secure. But out of sheer laziness, incompetence, and ego-stroking, security is regularly ignored, resulting in mass student identity theft and corporate espionage, etc -- but I guess this makes things a lot easier for the NSA and hackers, anyway...

SSL, Disable XML-RPC, bcrypt, auto-updates are a few easy ways to immediately secure WordPress that take minutes to setup.