Huh, never really thought about it this way. There really is no carrot to implementing secure solutions, only the stick when there is an incident.