The problem is that execs and companies in general don’t know how to achieve that. A great deal of security work at companies is cargo cult stuff designed to meet vague and largely irrelevant standards, without any real engagement with what’s happening in the company’s actual systems.

This is not the kind of problem that can be solved simply by motivating the kind of execs that have been allowed to succeed at today’s companies.

>One thing that programmers don’t care about. They don’t care about money, actually, unless you’re screwing up on the other things... You do have to pay competitively, but all said, of all the things that programmers look at in deciding where to work, as long as the salaries are basically fair, they will be surprisingly low on their list of considerations, and offering high salaries is a surprisingly ineffective tool in overcoming problems like the fact that programmers get 15″ monitors and salespeople yell at them all the time and the job involves making nuclear weapons out of baby seals. https://www.joelonsoftware.com/2006/09/07/a-field-guide-to-d...

Don't cut executive pay. Put executives in jail.

I'll bet that if Qantas ever get fined for this data breach, the fine/penalties will cost the company less than the increase in senior leadership salaries for that year.