Hmm. Although I don't agree with all that is said in the article. I find that it makes a nuanced and well structured point. Depending on what the security ind

Hmm. Although I don't agree with all that is said in the article. I find that it makes a nuanced and well structured point. Depending on what the security industry wants to achieve, they can either ridicule (punish) or ignore (reward) companies that at least publicize they've been breached. Keeping in mind that companies have a certain tendency to work short-term angles over longer-term alternatives. I think the carrot is more likely to achieve better security than the stick. But that's just my 2c.