I would suggest your security team do an audit with CloudLock (note, we acquired them at Cisco) and my guess is that it'll be illuminating / shocking.