The underfunded, understaffed, outsourced to death IT department, fuck yeah it has. Believe it or not, if you actually invest some resources in cyber defense instead of cutting it because it doesn't make profit, you get some functional cyber defense.
It's not impossible to do this stuff right, there are plenty of companies that do. It is impossible to do it on a shoestring budget with 3 staff to cover a 5,000 employee multinational.
If cybersecurity has outgrown your IT department, the CFO is the most likely problem.