Let's see the risk from the business standpoint and the chair of the board's standpoint. When you look at the expenses required for security, there comes a point when you evaluate the expenses needed for the security of the system and the losses caused by the reputational risk compared to the amount you have to pay to reimburse the victims. When reimbursement is cheaper, you forget about security and go for the cheaper way.
Do you discuss this aspect with companies? Do they realize that it's not just a question of losing money, but that, along with the money, there's information attached to it?