I propose that this issue be affected in a different manner; through legislation to make companies and the executive level personally liable for any and all dam

I propose that this issue be affected in a different manner; through legislation to make companies and the executive level personally liable for any and all damages due to breaches, to an extreme level to motivate the companies and people to alter their positions on these matters. I get that people have this desire to impose their assistance on others by testing and revealing security vulnerabilities, however, how would you like if someone knocked on your door one day and said, "hey, I was checking out all your doors and windows last night while you were sleeping and hacked into your security system, and thought you should know that it's all suuuuuuper insecure." I doubt most of us would appreciate that either. What we really really dealing with here is an abuse by the companies/services, where they have externalized the cost/risk of security vulnerabilities in lieu of profits and exec bonuses. If they had to internalize the risks/costs through my proposed damages, they would be quite motivated to prioritize even paying for white hat pen testing type activities, or even just opening up avenues for reporting and rewarding.