That's true in broad strokes, but I'm trying to portray things from the position of an executive. Having a bunch of outsiders that you have no real influence over in charge of your systems is terrifying.

The alternatives are a regulatory system for information security or offering advice and hoping companies implement it. There's a lot of advice on offer.