Post #2318749
2026-04-22 18:19 UTC
@sawaba@infosec.exchange no, not crazy, but sadly I think it's rare that a company that has a breach can actually change. There are so many examples of companies having constant security incidents without any real change.
My thinking is that unless security is actually a core priority and culture, nothing will change for real.
Replies (2)
-
@averagesecurityguy@infosec.exchange 2026-04-22 18:55
@gnyman@infosec.exchange @sawaba@infosec.exchange For security to become a core priority in most places the cost of the security incidents will need to outweigh the cost of the security program. So far the market cost of incidents doesn't seem to be enough.
-
@sawaba@infosec.exchange 2026-04-22 21:03
@gnyman@infosec.exchange a company that has constant security incidents and doesn't change suggests to me that the incidents aren't significant enough to hurt them