1) Has been told what needs to be done and decided to nix the idea because security is a cost center that cuts into their bonus potential.

Eh, while this happens its getting rarer and rarer. Execs know that if a cybersecurity issue is brought to them they kinda have to take it seriously (in 2020 anyways) or be the next Experian.

Edit: whoops Equifax, not Experian

What exactly happened to Experian? Their stock is up almost 100% since the breach announcement, and no one went to jail. If I were an executive looking to Experian as an example I would conclude that the market as a whole does not care about security.

It was Equifax that had the data breach, not Experian. Equifax was fined $700 million. Experian benefitted from the breach though since Equifax provided Experian credit monitoring services to those whose data was released.

Equifax stock has gone up since the 2017 data breach, though because consumers are not customers of Equifax, it's banks and lenders who are not concerned with data they don't control. If hackers had broke into Equifax and changed people's credit scores, the banks might have been a bit more concerned.

>Equifax was fined $700 million.

The equivalent of a regular person having to give up the coins they found in their couch cushions.

Experian is a pretty unique case, because the people whose data they lost (you and I) don't have a choice to not do business with them. And the people who actually do have a choice (businesses) realistically don't have a choice either.

Well, risk being the next Equifax, not necessarily BE the next Equifax.

If taking on that risk gives someone a 90% chance at a massive comp boost and a 10% chance at a more negative outcome where they're likely still well compensated, many execs would consider that.