Many California State Entities' Information Assets Vulnerable to Attack (opens in new tab)

"at its current pace it would take the technology department roughly 20 years to audit all reporting entities."

Also, interesting data presented here: http://www.auditor.ca.gov/reports/2015-611/auditresults.html