It's just impossible to avoid being hacked. If you're a big enough target, someone on the bleeding edge is going to have the desire and ability to get you. What if you're hacked because of a secret NSA backdoor installed in some firmware?
Fining companies heavily for being hacked is like fining someone for being rained on. Except, in this case, the rain is pretty much a guarantee, and the person knows that, and when they get rained on, their customers get screwed. So you fine them for not having an umbrella.
An audit doesn't necessarily need to be done the way it has before. It could even just be a bug bounty hackathon, like the big browsers do.
If whitehats had a ton of easy-to-find work to do, there'd probably also be fewer blackhats.
Comments
It's just impossible to avoid being hacked. If you're a big enough target, someone on the bleeding edge is going to have the desire and ability to get you. What if you're hacked because of a secret NSA backdoor installed in some firmware?
Fining companies heavily for being hacked is like fining someone for being rained on. Except, in this case, the rain is pretty much a guarantee, and the person knows that, and when they get rained on, their customers get screwed. So you fine them for not having an umbrella.
An audit doesn't necessarily need to be done the way it has before. It could even just be a bug bounty hackathon, like the big browsers do.
If whitehats had a ton of easy-to-find work to do, there'd probably also be fewer blackhats.
It seems you missed the "(...) if the security was lax" part.