That’s only motivation for InfoSec, though. The CEO has to be motivated to practice good security by the bottom line implications; if having a security incident

That’s only motivation for InfoSec, though. The CEO has to be motivated to practice good security by the bottom line implications; if having a security incident means less profit, a conscientious CEO will make sure to mitigate that risk, or at least factor it into the tradeoffs of what to do. Without any significant monetary threat, the ultimate cost of security breaches to a company isn’t truly a big deal.