In this conversation, I discuss the ineffectiveness of compliance violations and fines in changing corporate behavior regarding cybersecurity. I present data showing that fines are often negligible compared to company revenues, making them merely a cost of doing business. I argue for a reevaluation of negligence in cybersecurity and emphasizes the need for accountability, suggesting that without significant consequences, organizations will continue to prioritize profit over security.

Takeaways

Compliance violations are often seen as a cost of doing business.

Fines do not significantly impact large corporations' revenues.

Cyber insurance can offset the costs of compliance violations.

Statistically, companies often see stock price increases after breaches.

The current compliance framework does not enforce real change.

Negligence in cybersecurity needs a clearer legal definition.

Fines for violations should be more substantial to deter negligence.

Government organizations often escape penalties for breaches.

The data suggests a need for a shift in accountability measures.

Compliance does not equate to actual security improvements.