I think this article is making a decent point but with bad data. We know of many cases where the cost of insecurity drastically outweighed the cost of basic security. The most obvious is banking where no security would drain all their money. So, they combine preventing, detection, auditing, and computers hackers can't afford to keep losses manageable. Another example on putting a number on it is the Target hit that, in last article I read, was something like $100+ million in losses. Lets not even get to scenario where they start targeting power plants or industrial equipment whose management foolishly connected to net.

It also helps to look at the other end: minimum cost to stop most problems. Australia's DSD said that just patching stuff and using whitelisting would've prevented 75% of so-called APT's in their country. Throw in MAC-enabled Linux, OpenBSD, sandboxed (even physically) browsers w/ NoScript, custom apps in safe languages, VPN's by default, sanest configuration by default, and so on. Residual risk gets tiny. What I just listed barely cost anything. Apathy, which the article acknowledges, is only explanation.

A nice example was Playstation Network hack. I didn't expect them to spend much on security. I also didn't expect it to come down to having no firewall (they're free) in front of an Apache server that was unpatched for six months (patches are free). That this level of negligence is even legal is the main problem.