Money is hardly the problem,justifyin spending is. Same goes for hiring, lack of people who know enough to be a general practitioner or architect is the problem

Money is hardly the problem,justifyin spending is. Same goes for hiring, lack of people who know enough to be a general practitioner or architect is the problem not spending. > It sounds like the C-Suite needs to learn what they don't know and then hire a CIO+CISO. How???? You don't know what you don't know and you can only spend so much. A CISO that knows infosec is not easy to find. Like i said in my comment what companies do is based on incentives. If you believe they should be more liable then get laws passed and their risk assesment will justify the spend. Truth be told financial and reputation loss are the only concerns for a business,why is that surprising? They should be more responsible? Yeah...that's not how capitalism works, IT is an expense that you make up for using your revenue sources,doesn't pay for itself directly. You want them to spend 1M/year on a decent CISO and 200k+ on a team of security experts? Imagine how silly that would be for most companies with less than 5k employees! Give them a legal incentive and make security better using other avenues such as better IT products and services (which many are doing) Oh and about salesforce...their main business is IT! They have quite a sizable revenue and a breach would affect that precious revenue very significantly. As opposed to say...home depot,99% of their customers who don't work in IT never even heard of their breach,heck I meet people in infosec who haven't either and they shop at homedepot just fine. Also,when a lot of companies are breached their stock either remains unaffected or it actually goes up because the breach is PR! To me the whole thread and site is showing me the scale of the infosec bubble/echochamber. Too bad for karma though :)