It's easy to fall into a re-active, firefighting mode, especially in a small company setting where you're the only one on the IT staff, or one of just a few. Lax network security is a prime way to get there, it can create an astounding number of fires that burn endlessly, and usually leads to unorthodox fixes that cover up or band-aid the problem making things even worse in some cases, but only providing temporary relief in the best cases.
I walked into a network one time with a completely unprotected file-server. Everyone used it, and everyone had access to everything on it. Luckily no one was smart enough to hack any payroll files, but other company financials were out there. I lucked into finding it early because I walked by an employee who was looking at some spreadsheets in a folder with the company owner's name. I stopped her and told her to close the folder. I know it was just an excuse of ignorance, but I almost laughed at her response because it was so true... "I figured if I could get to it, it was ok for me to look at it"...