Regulation is absolutely capable of reducing the damage done by these types of attacks and incentivizing companies to make the necessary investments. Nothing will ever be 100% secure but that is no reason to just give up on trying. We tried letting the free market do the right thing and it failed, this is the reason the government exists.