I think the time to “address” data security concerns are before you get pwned and millions of records get taken. It blows my mind how many companies get taken for millions, tens of millions, or hundreds of millions of records and only find out after the fact.