Don’t be surprised if companies would rather roll the dice than pay whatever it costs to prevent the problem.

$4 million once times the risk of getting hit vs. the up-front and ongoing costs of dealing with an overly paranoid IT guy.

Tough call.