I haven't seen any evidence of that. Those people respond to incentives and there are few current incentives to push companies to spend time on security, especi

I haven't seen any evidence of that. Those people respond to incentives and there are few current incentives to push companies to spend time on security, especially preemptively. Yes, there will be some public blowback if you're compromised, but that will blow over. Plus consumers are well aware that this is happening all the time to other companies, so it's become "normal" behavior now. The fines for neglect of personal customer data need to be so high that the boards of these companies and their shareholders demand that their executives make security a priority. HIPAA (https://compliancy-group.com/hipaa-fines-directory-year/ https://compliancy-group.com/hipaa-fines-directory-year/) is a decent model and it does seem like security is taken more seriously in the healthcare industry in general. That being said, the actual fines are relatively low when you look at the size of some of these companies. Anthem is one example: https://www.hhs.gov/about/news/2018/10/15/anthem-pays-ocr-16-million-record-hipaa-settlement-following-largest-health-data-breach-history.html https://www.hhs.gov/about/news/2018/10/15/anthem-pays-ocr-16... That was the largest HIPAA fine ever ($16 million) for a company that pulls in $90 BILLION in revenue each year and 79 million people had their information compromised in that event. That fine is basically a rounding error for them. Still, this outcome is better than what happens with most non-healthcare security compromises, which is basically nothing except "we're sorry, we take security seriously, and here is one year of credit monitoring."