Personal, outsider take: it’s unlikely that US businesses will start spending sufficiently on cybersecurity, because it’s difficult to show ROI on this. The government is correct on treating this as a high priority.