It's reasonably well established that humans systematically underestimate low-probability, high-cost outcomes. Getting hacked is already pretty high-cost for mo

It's reasonably well established that humans systematically underestimate low-probability, high-cost outcomes. Getting hacked is already pretty high-cost for most organizations. Given that, I think there's more to be gained by looking at the "low probability" side of things. Some historic examples of attacking the "low probability" side include building codes and speeding fines - both have pretty strong evidence for their efficacy. A comparable initiative for software might fine those found keeping data after they do not need it (like GDPR), or mandate that sensitive data is stored behind appropriate access controls (like PCI does).