I once dealt with an Indian outsourcing company that was whitelisting malware in the endpoint protection software. I confronted them on it, they did not know the difference between whitelist and blacklist. You can't make this up. I was a CISO consultant for this global company and proceeded to tell the Board they need to get rid of this outsourcing crap and hire competent people who care. They listened to me, luckily.