With the idea of "Security Architecture" and "Protection Profiles" in mind, what could be some of the consequences for companies who fail to implement these controls in their environments? Be specific, don't just tell me "they could get hacked".

What could be a consequence of a company rolling out end-user workstations without "functional" requirements and "assurance" requirements? Are all the consequences security related? Could they also be "user experience" or availability-related? Does the impact change for servers (rather than workstations)?

Do the consequences or impact change if it's a corporate enterprise (i.e. >5,000 users)? How about a small business (i.e <500 users)?