Have you ever dealt with PCI or HIPPAA compliance? It's all about checking boxes. This approach has not worked. We need to adequately start pricing in the cost

Have you ever dealt with PCI or HIPPAA compliance? It's all about checking boxes. This approach has not worked. We need to adequately start pricing in the costs of externalised losses, and studying what actually works, otherwise nothing will get better.