Everyone has their own reasons for not actually fixing the root cause of so many problems, but I've found that the larger the company and the larger systems ent

Everyone has their own reasons for not actually fixing the root cause of so many problems, but I've found that the larger the company and the larger systems entropy that's been uncontrolled has manifested the less the business actually has any truly actionable control over actually fixing anything anymore - the inertia of old, bad systems that your business relies upon to keep the lights on is just too much to overcome. For starters, legacy application architectures and systems that just can't be offline nor actually fixed by a vendor can be a hard block. Add in so many vendors and contractors involved as standard for most large companies, add a lot of internal politics to the mix, and the reality becomes that the most cost-effective solution is sadly to just not fix anything and to just pay for PR damage and the credit monitoring and some more random security consultants to make people feel better somewhat. A big component of real world security practice is that fixing things has real, serious costs and so businesses will compare those costs to the costs of simply not fixing them and rolling some dice. Even the ever-critical Bruce Schneier understands and recognizes this reality.