> Probably not, if you factor in the cost of security exploits. A single compromise can potentially sink the business.

Agreed however getting humans to understand probability is tricky.

I had this discussion with my son recently about considering the severity of outcome multiplied by the probability of that outcome been the way to look at some things.