So many companies in the UK don't seem to get it (or are purposefully doing bad security), we need regulation .. or perhaps just application of current legislation (I don't know) ..

There needs to be someone saying "you restricted your passwords to 8 alphabetic characters, your C-grade in charge of security can no longer hold a position that involves security, and you company must pay 50% of profits (subject to a minimum of 5% of revenue) as a fine.

With a very clear, basic, definition of minimum security levels for companies (above a certain size) to comply with.

We can't leave security to the market as the information isn't public and the market on the whole can't comprehend it.