Consider many other product markets, when there is a defect in someone's product there are legal remedies. These are in place to provide an incentive for compa

Consider many other product markets, when there is a defect in someone's product there are legal remedies. These are in place to provide an incentive for companies to do something they otherwise would not. Examples of this would be food safety legislation, fire safety legislation, building regulations etc. In all those cases it was considered a good thing (by society) to implement laws to make companies take these things into account. IT in general, lack this kind of legislation, and as a result companies unsurprisingly make commercial decisions not to improve security where they feel it would cost a lot of money to do so. The problem comes in the negative externality, the company with bad security isn't the company that takes the loss, similar to the negative externality that the person who made a weak bridge likely doesn't die when it collapses. So a logical argument might be to use legislation to fix this externality and make it a better decision for companies to improve their security...