Great response from jedberg about the business costs of security and the fact that a company can take it seriously and still have a breach: https://news.ycombinator.com/item?id=9834461