Let's say that you're a CEO at Big Pipeline Co. One day your phone rings. It's the NSA. They have a report with a list of vulnerabilities. If you don't fix

Let's say that you're a CEO at Big Pipeline Co. One day your phone rings. It's the NSA. They have a report with a list of vulnerabilities. If you don't fix them to your satisfaction, you will be fined in 2 months, 2 months after that you get fined and publicly reported as negligent, and 2 months after that you get fined again and your outstanding vulnerabilities will be published for everyone to take advantage of. How much effort are you going to put in to securing your infrastructure?