What happened to the responsibility of corporations for corporate security? Including corporations that are the victims of attacks, and corporations that sell buggy operating systems and applications?
Why does the government have to provide the red teams? The general attitude is all government agencies are wasteful and incompetent, except in this circumstance where the wealthiest corporations in the history of the world apparently can't spend enough to fix their own crap. But the government not only can but should??
This just sounds like externalizing costs to the public while banking record private profits.
How about rather than subsidizing software corporations we talk about liability laws and fines, like any other physical industry that releases dangerous, broken products. Or an insurance system that is funded by a portion of the profits the software industry makes. Then we're actually making the software vendors feel some pain which will incentivize them to release higher quality code.
The problem does not fix itself until the investors start truly losing money, the care, unlike the Equifax case. Until the portfolio value cannot go down 90% there is not going to be a change in corporate actionism.
The govt only has a relative abundance of talent [largely interspersed with its contractors] in highly regulated activites like making nuclear weapons, where private entities don't participate.
I guess the government could legalize ransomware hacking to encourage it, but that'll never happen.
This would have the beneficial side effect of flushing all the incompetent paper-pushers / requirement-box-checkers out of the security industry.
If you're found vulnerable, that's a fine. If something gets accidentally broken in the exercise, that's the price of commitment.
Nothing is going to change until you increase the frequency / likelihood of breaches for these companies. If it's a yearly cost, it gets addressed. If it's a catastrophic possibility, it gets ignored.