Would you hand a stranger the keys to your car with an unlocked briefcase filled with money and personal information open in the back? Probably not. So why would you have an insecure website sit in parking lot with the windows open? Well you probably wouldn't knowingly do that either. Yet virtually every Drupal site we've reviewed has been at least somewhat insecure. One of the primary reasons for this is, Drupal is at least somewhat insecure out of box, especially if your site isn't using the latest version.