The costs of bad computer security are also often borne by entities other than the organisation who gets breached, even taking breach notification, privacy laws and the potential cost of lawsuits into account, which also doesnt really provide an incentive to dedicate resources to improve security.