That's a joke. It would take them a lot more to fix than 400k. Just the pentests + risk assessments would cost more and they would also need to educate their pe

That's a joke. It would take them a lot more to fix than 400k. Just the pentests + risk assessments would cost more and they would also need to educate their personnel (developers, testers, DevOps, managers), and implement new policies and procedures, SDLC etc. The price of all of that would be well over a million. 400k is not even a slap on the wrist. I'm disappointed.