Companies have little direct motivation to have good security practices, they're only motivated to manage their reputation. Any attention they pay to security is only a side-effect of caring about reputation management.
And as we've learned from significant breaches, there is rarely a reputational hit for even the biggest breaches. Anyone remember that time Target accidentally doxxed 70 million people? I don't think there was any noticeable difference in their income or profits.
And ultimately, the only reason they care about their reputation is because it affects their profits. For-profit companies optimize for profits, as always :)
So the mom-and-pop donut shop on the corner always optimizes for profits? The local donut shop?
Most companies do not actually optimize for profit. If they did they'd stop whatever it is they are currently doing and switch to whatever industry makes the most profit. They don't though, they keep making/doing whatever it is they start with generally. That means they aren't actually optimizing for profit.
* if everyone who sold donuts suddenly went into AI there'd be a huge profit opportunity in donuts - optimizing for profits would be to wait for the other donut sellers to switch into AI and rake in the cash.
* the cost of retooling constantly based on the latest profit fad would just make the toolmakers the main profit center, and the toolmakers would just use their own gear to take all the profits in abandoned markets.
* the constant shift of areas of business would be sub-optimal because most people entering it would know nothing of how to succeed in that field, it's not optimal for your company to be incompetent in an area with much competition.
* labor costs in the "only profitable field" would be through the roof as everyone scrambled to hire competent people - not an optimal way to maximize profit in a crowded industry (also, this compounds with the above point).
In fact this idea is so bad (and yet weirdly beleived by many) that every boom there's memes and jokes about how absurd it is that random companies from completely different industries are getting involved... as if they have a chance to compete against the established players. And even more jokes about how they predictably go out of business.
Not all work is equal. Value is derived from having an edge over the competition. If you are a good baker then baking may be optimizing for profit. Also if everyone just switched to X it wouldn't be the best option anymore.
Profitability is important to any size business. Profit growth is what many large business C-levels obsess over because they get to eat a slice of the expanding pie.
Its almost like if they want a piece of the expanding pie hell be damned, they should recieve actual liabillity criminal and civil for the trouble and take away any profit incentive that drove them in the first place
Any business will optimize for profit > 0, otherwise it’s a loss making business and will shut down sooner or later. Not all businesses optimize for maximum possible profit.
Umm… continuing the donut example, the owners are likely maximising their return given their skill sets, knowledge, time, etc. But return is pretty nuanced too bc it probably is not just be profits, but family time etc. in any event, I think you’re right that businesses don’t just focus on profits. But the example doesn’t prove the point.
No. There’s prestige and power in running high profile companies.
It’s a middle class fantasy that money is power. Look at the Cheeto. How many times has he been bankrupt? What does he say about bankruptcy? He knows he’ll be fine because power brings money, not the other way around.
Taxing billionaires will help the economy absolutely, but it won’t control the billionaires, because a lot of their deals aren’t denominated in hard currency. We don’t know how to tax favors or threats.
Money is definitionally power. Its sole purpose is to convince other people to do things you want them to do. Thats what power is.
There are other sources of power besides money, but money is definitely one kind.
Consider Twitter. Musk managed to get institutions to put up a fabulous amount of money, but he still had to pay a massive amount himself. If he had $1,000 in the bank and nothing else, that deal would never have happened. Heck, even with $1 billion it wouldn’t have happened. As it was, he got to take a couple dozen billion units of monetary power and convert them into massive non-monetary power.
Give the plumber $2 million and he still won’t be taken seriously at the country club. He can try to buy influence from local politicians, but that only works until an older family disagrees with him and offers something better. Like a job for their niece. Or not to publish those pictures from that party.
Companies do have a motivation to have good security practices (and disclosure), because they are motivated by their reputation which is essential for customers to trust them to be customers, even more with the proliferation of SaaS means more longterm relationships and customer data.
The challenge is for customers and companies to communicate and agree to the new social contract.
