Nobody Cares About Security

And monthly insurance bills that explicitly reflect discounts/charges paired to inspection histories & inspector statistics.

Suddenly efficient but strident inspectors will find themselves gods of seasonal demand.

Glad that was clarified, I was afraid I was "Nobody".

What the author is trying to articulate makes me wonder if he considered what security is.The core properties we mean when we say "security" are the CIA triad (confidentiality, integrity and availability). You can't tell me a "business leader" doesn't care about any of those. You have business related information that is vital for your business continuity and profitability. The confidentiality, integrity and availability are what we generally mean (not always though) when we say "security".

I'd argue that business leaders do care about security a lot. I think what the author means is "nobody cares about security for the sake of saying you're secure", but even then, business leaders do care about theatrical security, because it helps them sell their products and services. "we have a state of the art, military grade, encrypted cybers, unlike the competition". There are even popular and profitable security vendors whose main service is rating the security posture of companies, so that when you do B2B you avoid poorly rated businesses that won't protect the data you will share with them.

Security for individuals is a different topic than businesses, it's almost a different ballgame altogether.

Use APTs as an example, should some mom&pop small/medium size business care about them? Certainly not. They should care about ransomware though, because chances are, they can't afford the downtime and ransom payment. Should a defense contractor business care about APTs? yeah, like all of them and then some.

Context and nuance are important.

It's just that it is not the norm, so expectations are low. Some companies consistently do better than others, so clearly it's not all down to luck.