> In most fields there is little incentive to change things when the company itself isn't too affected in case of hack. This is steadily changing. I've had a f

> In most fields there is little incentive to change things when the company itself isn't too affected in case of hack. This is steadily changing. I've had a few recent engagements where i've been asked to evaluate the security practices of potential partners and suppliers and in one case the result affected a sourcing decision. I can see this becoming more common, which could eventuate into a credit-reporting like bureau setup to audit security and privacy practices.