Companies have little incentive to pick vendors that don't get other people's data stolen. Imagine there are two vendors offering a service: Vendor 1 costs $1

Companies have little incentive to pick vendors that don't get other people's data stolen. Imagine there are two vendors offering a service: Vendor 1 costs $1 per unit of service, doesn't give a shit about security and will probably get hacked. Vendor 2 costs $1.2 per unit of service because they care about security Then if it's not your data that's about to be leaked, the "smart" (profitable) thing to do is to not look at the second part so you can pretend you didn't know, and pick vendor 1.