I liked Office 2010 a lot. Office 2013, not so much. It's fine, but not great. But I know that it is just a first step on their road to pure JavaScript in a browser, so I appreciate the technology that it is enabling.
Yeah, we're trying to take a more holistic approach to security. Whether virus, malware or phishing, we're trying to be the one-stop place for security reputation for processes, IP address and URLs.
I was thinking more about controlling rules in Exchange. If HR need to be involved to get something enforced then I may as well forget it.
Then why the concern? If management and HR think it doesn't matter then it should definitely not concern you. Not IT's place to make those kinds if calls.