Why Companies are Smarter about IT Security