Anecdote: A friend of my runs a consulting business. He does webapps, but generally has to set up the webserver if he doesn't have to provide hosting. He's a

Anecdote: A friend of my runs a consulting business. He does webapps, but generally has to set up the webserver if he doesn't have to provide hosting. He's a fantastic programmer. I came to find out that he hadn't disallowed root SSH yet or implemented SSH keys. With that said, I would say most probably don't unless they have someone with sysadmin experience or likes infosec. Perceived value? Certainly, if you can convince them that if the data gets corrupted or stolen or you get haxx0red by script kiddies there's going to be a financial consequence. Will they pay? I don't know. It's risk management between site/data loss and paying to set it up.