In EU, NIS2 regulations already hold top management personally liable both financially and in worst case criminally.

Does wonders for how c-level treats compliance work, now if only middle management followed...