Security is a huge concern for companies and largely executives who typically aren't as technical. It keeps them up at night, mainly because they can't control it and to a certain extent they don't understand a lot of the technical details and attack surfaces.

In January I founded a DevOps and infrastructure consulting startup (shameless plug https://elasticbyte.net) and security audits and best practices is one of the top "value" adds of my service. I don't claim to be a crypto expert or DevSec guru, but most of the issues aren't deeply technical problems like what CloudFlare experienced. Usually it just takes rigor and following best practices, firewall rules, don't share keys and passwords, two factor auth, use IAM, use jump hosts, if a server doesn't need public access don't provision a public address. Isolate services and dev and staging environments.