Surprisingly few companies (or people) care about paying for good security.
Is buying antivirus "paying for good security"? Hiring the first security firm that showed up in a Google search?
If you advertise for a security person to join your company, how do you effectively interview candidates?
They paid Accenture and Gartner to tell them what to do.
Ditto for having them set up a security organization -- get Accenture to sit a temporary CISO, hire some people, and then fuck off. Hopefully the replacements work!
Mom and Pop shops might use Google, but in 2024 they're usually using whatever the local, oversubscribed MSP is selling.
"Passing our audit" has been presented with measurable consequences (cannot sell to customers) and finite, well-defined actions (this is what the audit list looks like).
What I'd like (the goal of the follow up article, coming soon) is to present the value of security in a way that makes the justification of the effort viable and palatable.
What people do not give a shit about is digital security. Because nothing about computers or the Internet "is real". And it's getting less real by the day. That's the fascinating psychological talking point.
Our culture in particular excels at implementing this bias.