Well, yes. But beancounters are allied with the Manglement in this.
At the moment, it's cheaper to have basically no security and be breached and then go to the police and say "we were hacked by a uber skilled hacker". When a court sentences them then you can change the person found guilty costs for somewhat securing your systems. This leaves no incentive other than PR for securing your systems.
This is probably going to change now GDPR is in (at least in europe); once a few epic level fines go in then it's going to be cheaper to secure systems first to avoid having to pay 20% of your business turnover in fines per offense. This provides a very good incentive to adequately secure your systems.
Biting the hand that feeds IT
