“The farther up the chain a non-security manager is found the more likely he or she thinks that they understand security and that it is easy.”