Don't underestimate the value of checking all the security compliance check boxes. It solves what really matters - protecting executives from prosecution and/or being dragged in front of Congress to testify. <sarcasm off>

Seriously though, so long as cybersecurity insurance and "industry best practices checkbox management" is easier and/or cheaper than actual meaningful security measures, it will never be solved.

Worse, when a meaningful security measure that could actually make a difference collides with something in a best practices document, you know who will lose.

I'm not cynical at this point, no...