3 ms·
Companies have some incentive to check the boxes, because they are often required to. Do companies have any incentive to improve their actual security posture?
by Buttons840 2y ago
Companies have some incentive to check the boxes, because they are often required to.
Do companies have any incentive to improve their actual security posture? Has a company ever been harmed by having a poor security posture?
I get your argument, there's some truth behind it. Being able to focus on actual security and less on security theater could be a good thing. But cynically, I think we're replacing a real incentive (security checkboxes), with non-incentives (actual security).
- alephnerd 2y agoI work in the industry and partially disagree with OP. There is credentialling BS but it's not regulators that push that. Regulators like the SEC instead require disclosure of breaches when they happen, and agencies like CISA have stepped in to remediate and fix deficient organizations after an attack (Hartsfield-Jackson Atlanta International Airport is a notable example) Now with Chevron removed, a breached entity could sue against mandated disclosure or government mandated remediation.