Until "cyber" insurance underwriters suffer catastrophic losses and the price for policies rises accordingly I don't think we'll see any significant change in IT security status quo. If doing the right thing is more expensive than insuring away the risk the business will always make the cheaper decision.