Specifically, what is needed is for executive management to require and demand the enactment of adequate security risk management measures aimed at reducing the number of insiders who have unrestricted access to the IT infrastructure i.e. Domain Admins, Enterprise Admins and the like, i.e. folks whose job titles read Infrastructure Consultant etc.