that's definitly not the case. I know of two incidents, where they basically didn't invest into more security, "since it won't happen again".