This is also why cyber security and infosec has been avoided, ceos don't want to spend the money, until something bad happens and they have no choice, and then its way more expensive to fix after the intrusion.