the challenge is "how can you prove that this risk will materialize and will cause $3 damage - while the pill costs $5 - and what will the shareholders do". I've been in Audit/GRC/Security for enough years to have had enough 'fights' on risk management. With very few exceptions, the money defines the risk and not the other way around.
If history has taught us anything, it will be IT-Sec-trainwrecks-all-the-way-down.
> but that’ll happen because the problem is hard to solve and not because people ignored what their CEO and senior leadership told them to do
no disrespect to a/this CEO.. but he is 'just' an employee. And he can always tell different things to the Townhalls and the Press/Media, but pull a U-turn. All he has to do is reduce the budget of X-dept, reduce the headcount/org-chart of Y-dept, and while the intentions are great, the effort is not supports (I've made one more comment on this thread about staffing initiatives somewhere higher/lower in this article's comments)