What does it mean to "hold orgs to account?" Let's unpack this.

When some organization promises to do a thing and they fail to do the thing, then sure, you can blame them for breaking their promise.

This doesn't fix anything though.

To fix things you need to talk about preparedness. Whose job is it to prepare? Do they know what to do? Do they have the resources to do it?

Increased penalties for failure aren't going to fix it. And especially, deciding afterwards that someone should have known it's their problem isn't going to fix it.

Why wouldn't increased penalties for failure do it? We're in an environment where spending money on better security and preparing is seen as waste. If the alternative is having a large fraction of your profits confiscated because you were being negligent, that seems like the most direct way to address the mindset at the organization level.

If investors ask why you're spending so much on ITSEC, you point at regulatory requirements.

Someone has to point out the possibility of failure to someone who can do something about it. Where is the incentive to point it out or spend time looking for failures? Particularly when it's not their job? You need to make it someone's job.

In some cases, insurance can do it. It's the insurance company's job to understand and minimize risk.

But the best idea I've read is to have a regulatory agency like the NTSB.

I agree on all fronts. Preparedness is the clearest way. But our economy (and capitalism in general) don't reward preparedness, in fact they often punish for it. I read some article about how building slack into systems is equal to building resiliency into them. How can we build an economy that aligns incentives to be resilient?

The same applies to pandemic preparedness. There is no incentive for a hospital to over-provision beds that are empty most of the time.

Looking for examples of cultures and organizations that over-provision, the military might be an example. Why do we translate worry about physical attacks into action but not cyber attacks or environmental harm?

Because we have had millennia to observe the effects of physical attacks, but the other 2 are much more recent? We haven't yet learnt the hard way.

The underwriting of business ventures goes back at least three centuries, and the market process aligns incentives pretty well. But if you think you can price over/under-preparedness better, that sounds like a profit opportunity for you.

> Let's unpack this.

It's probably a fallacy to assume this can be fully digested in a public forum. Things like this require committees and trust and understanding of the problem. Software threw all that out the window years ago.

We can just pray the AI will know better.

How to do that though? See these people, using the Insurance companies stickler for the small print against them: https://www.abc.net.au/news/2020-12-15/australians-fight-ins...

In short, the insurance companies have a phrase where they don't have to pay out for business losses caused by disease as specified by a certain law.

But that law got wiped from the books and replaced with a new law. And the terms of insurance for most of the companies never got updated and so are irrelevant on that point.

So the insurance companies should pay up for business losses due to covid. They are now saying "never mind the exact lettering of the agreement, go by the spirit of it"....

“Too big to fail” has been mentioned often as a danger to a well working society.

But then again, as long as there is reasonably rapid evolution in society, I have no idea how one might curtail organizations from becoming too big.

At best it would become another game of Whac-a-mole[0] between regulators and organizations, with regulators more often on the losing side than not.

[0] https://en.wikipedia.org/wiki/Whac-A-Mole#Colloquial_usage

The market process and diseconomies of scale tend to constrain the size of firms, so much so that "bigness" is a strong indicator that a firm is instead being propped up by the political process, e.g., bailouts, regulatory capture.