> As long as management thinks there has to be a ROI of investment into the blueteam/cyber defense part, nothing will change. Security shouldn't be exempt from

> As long as management thinks there has to be a ROI of investment into the blueteam/cyber defense part, nothing will change. Security shouldn't be exempt from ROI concerns, that's bizarre. Governments should regulate more, to make good security have a positive ROI. Or introduce criminal liability, I suppose.