>massive fines so they actually "take security very seriously" The bad publicity around such a hack can very much turn a company belly up. Massive fines will n

>massive fines so they actually "take security very seriously" The bad publicity around such a hack can very much turn a company belly up. Massive fines will not alter the incentive structure significantly, they already know a hack is a bad thing. On the other hand, there are plenty of interventions that would change the security incentives. For example, decriminalize white hat hacking to allow access to any internet connected system, as long as the vulnerability is reported within 7 days to the relevant bodies and no data is duplicated/altered. Heck, award prizes for it.