> As long as management thinks there has to be a ROI of investment into the blueteam/cyber defense part, nothing will change.

Security shouldn't be exempt from ROI concerns, that's bizarre.

Governments should regulate more, to make good security have a positive ROI.

Or introduce criminal liability, I suppose.