Soft/Hard only considers one side of the equation, the level of security provided. It ignores the other side which is what is needed or expected. Without doing

Soft/Hard only considers one side of the equation, the level of security provided. It ignores the other side which is what is needed or expected. Without doing that you can not tell if you are dealing with soft/hard or tissue/paper. A more meaningful distinction is profitable/unprofitable and, if you really must rely on other people being tastier fish in the barrel, ROI. For example, if company A costs $10K to hit for a return of $100K, but company B costs $100K to hit for a return of $100M, the only reason someone would hit A knowing this information is if they did not have enough capital to hit B. I agree that not everybody needs to be able to withstand an attack by state actors. It is up to the involved and affected parties to choose the level of security needed. However, the highest level of actual security I have heard from people is ~$1M and I would be hard pressed to find any appreciable system in a moderately-sized business where the negative consequences would be as low as ~$1M. Frankly, $1M is chump change in the commercial world. If that is all it takes to compromise nearly any system or organization in the world, then a sizable fraction of the people reading this comment and around 46,800,000 people worldwide have the personal resources to compromise any system in the world. That is terrifying.