Every business owner is either ignorant (default), has made the wilful calculation that risk < cost, or is so busy barely surviving that things like security ar

Every business owner is either ignorant (default), has made the wilful calculation that risk < cost, or is so busy barely surviving that things like security are not high priority enough to get attention. Security is fundamentally a resource attribution problem. Overspending on security results in high opportunity cost. Under-spending on security results in high risk in terms of trust and money, as well as poor national security. A valley company that takes security seriously will: Hire experts. Scope attack surface/risks. Implement direct mitigations. Implement policy. Implement defense in depth. Develop a system capable of discovering indicators of compromise (IOC's). Verify security via bug bounty and pen testing, both internal and external. Clearly most of these things are not "features" and therefore are a cost. Furthermore, since every company must impeliment these, the cost of security for society at large is an O(N) problem. We must set up a system that mitigates the unpayable O(N) cost of security. Pen testing/Bug Bounty/verification is probably the most easily scalable problem to solve. Whether you unleash hackers on companies by indemnifying them or specifically pay for Project Zero like entities or turn our own nation-state attackers against US companies with the weight of the US government behind it, it seems quite feasible to create scaled cybersecurity monitoring which can then better inform both technical solutions and policy solutions. Once companies know they have poor security and once a business can see being breached as a certainty rather than a potential risk, I think the free market can probably solve the problem.