The comments at the end agree with my experience of working in cybersecurity. Companies just don't want to spend money on security. Any proposal to spend money is met with: what is the return on investment? Of course, the return is zero until something bad happens. Another common attitude is: we haven't had a problem in the past, so why should we worry about it? Another aspect of the proliferation of the internet of things is that industrial control systems are now typically just software running on networked PCs, which are connected to the corporate network, which in turn is connected to the internet. The connection could be secured, but again, it is expense that companies prefer to avoid.

I have a feeling that a “hack” of a major financial institution will be the “black swan” of the next financial crisis.