I have worked IT for 2 Fortune 500 companies and let me tell you NONE of them took data security seriously.

Neither has 90% of any of the other sites I've worked on.

In my experience so few companies bother spending appropriately on it because IT is considered a cost center instead of a needed service.