At the industry level, the boundaries of security responsibility among device vendors, system integrators and end users are blurred: vendors believe security after deployment is the user's responsibility, users rely on integrators to provide protection, and integrators often lack security capabilities.