Companies won’t take security seriously until 1) customers demand methods of evaluating the security of a company and making purchasing decisions accordingly —

Companies won’t take security seriously until 1) customers demand methods of evaluating the security of a company and making purchasing decisions accordingly — “size of security team” doesn’t count, and 2) sufficiently punishing companies that cause user harm through security failures, i.e. forcibly liquidating Equifax and confiscating all senior executives’ assets including their house.