Sorry, no. He cannot under UK law "accept the risk of a security breach" unless a UK Judge deemed it unreasonable to spend "$10 million to avoid a possible $1 m

Sorry, no. He cannot under UK law "accept the risk of a security breach" unless a UK Judge deemed it unreasonable to spend "$10 million to avoid a possible $1 million loss." A judge may well agree that it is unreasonable but he cannot use the financial loss to the company as the only metric to make that decision.