[daraosn]

True, but it's also:

- How much would it cost to repair the trust of the users if the breach occurs. PR, marketing, organizational costs

Do you think a big company would pay $5k for a PR campaign to fix a mess due to a breach of private data? Not remotely.

[raverbashing]

It's always a question of probability: expected cost x expected probability gives you the end cost

You don't lock a $1000 bike with an $1000 lock, maybe with a $100 lock though