It does not work, in such a myriad of ways that I'd be blown away if it wasn't just some summer intern's project three years ago and it hasn't been touched since. But it does check boxes for audits. And enterprises don't care about actual security, they just want to check boxes for audits.