> And security work is rewarded even less

While I do recognize that this is a pervasive problem, it seems counter-intuitive to me based on the tendency of the human brain to be risk averse.

It raises an interesting question of "why doesn't the risk of security breaches trigger the emotions associated with risk in those making the decision of how much to invest in security?".

Downstream of that is likely "Can we communicate the security risk story in a way that more appropriately triggers the associated risk emotions?"