"Maintenance is never as rewarded as new features,"
And security work is rewarded even less!
And security work is rewarded even less!
While I do recognize that this is a pervasive problem, it seems counter-intuitive to me based on the tendency of the human brain to be risk averse.
It raises an interesting question of "why doesn't the risk of security breaches trigger the emotions associated with risk in those making the decision of how much to invest in security?".
Downstream of that is likely "Can we communicate the security risk story in a way that more appropriately triggers the associated risk emotions?"
What's the risk? The stock price will be back up by next week.
Look at the crowdstrike failure as a recent example, but there's plenty more in the past.