I’m a cybersecurity professional. The problem with dealing with these problems is purely financial incentives. Companies don’t properly budget for this stuff simply because there is no money in it and cybersecurity is a crappy career. If you do a great job, nothing happens and nobody cares. People are too focused on making money or growing revenues to cash their stock out. Especially the smartest people.

It’s the same exact problem with saving the environment. It’s exceedingly complex, it slows down time to market, costs extra and it’s a whole lot easier to create theater — just looking good vs doing the hard and sustained work to actually solve the problem.

I’ve worked with quite a few executives and CEOs on this problem, and they said it’s extremely difficult to create a risk management program with the proper incentives and recognition to get funding from the Board and attract good talent.

The best security people wait for a huge train wreck…when people are willing to pay them more than the wage you would pay an administrative assistant.