Stand by while I work out what 65% of 100 is.
this post was submitted on 02 Apr 2025
87 points (98.9% liked)
Cybersecurity
6894 readers
238 users here now
c/cybersecurity is a community centered on the cybersecurity and information security profession. You can come here to discuss news, post something interesting, or just chat with others.
THE RULES
Instance Rules
- Be respectful. Everyone should feel welcome here.
- No bigotry - including racism, sexism, ableism, homophobia, transphobia, or xenophobia.
- No Ads / Spamming.
- No pornography.
Community Rules
- Idk, keep it semi-professional?
- Nothing illegal. We're all ethical here.
- Rules will be added/redefined as necessary.
If you ask someone to hack your "friends" socials you're just going to get banned so don't do that.
Learn about hacking
Other security-related communities [email protected] [email protected] [email protected] [email protected] [email protected]
Notable mention to [email protected]
founded 2 years ago
MODERATORS
Did ... Did you ever figure this out?
Yes. It's about ¾. Less, I think. But more than ½.
65 per 100 of the 100 largest.... nope, I've got nothin'.
Most organizations in the US don't value cybersecurity as anything more than an abstract concept. The reasons for that can be numerous but in my experience it's usually a combination of cost + survivorship bias.
Lack of serious consequences is another factor. Had a breach? Pay a small fine and an even smaller settlement (or should I say your insurance pays) and then it's back to business as usual. Even in situations where the breach is due to gross negligence, the consequences are minimal (see Equifax).
In my experience it has been that the company cares about security but they keep hiring the cheapest contractors from India who know nothing about security and they introduce holes faster than onshore developers can fix them.
Either way, you can point to cost cutting as the underlying root cause.
That and IT is often seen as the redhead step child because they're not revenue generating. I've had a purchase request for a single bag of zip ties denied before.
Plus security is one of those if everything goes right "what are we paying you for" and if something goes wrong "what are we paying you for" parts of the business.
Deny the request to fix their laptop or replace their broken mouse. I've found that usually works.
That doesn't work when it's the CFO denying the request.
Very true. It's why IT shouldn't report to the CFO (though it almost always does).
I wish we could make fines a percentage of unrealized gains that are over a certain amount. That would make some of them care.
People making these decisions are getting paid millions!
While nurses get fucked
Welcome to America!