Within our industry I’ve sat in entirely too many meetings where executives removed basic security investments from the roadmap over the objections of engineering. They understood the risks of doing so; they merely concluded that the personal consequences were both small and unlikely.
It seems to me that our current regulatory framework will remain untenable until enforcement has a very sobering deterrent effect.