[closeparen]

Competing harder for the limited pool of competent security people might redistribute breaches away from your company onto others. From a local perspective this could be rational but as a society we want to be less vulnerable in aggregate.

(Although there I think the IT operations side is vastly overblown and not nearly enough attention is paid to quality control on the most popular software packages. Want to make every business substantially more secure at once? Take a hard look at Windows Server, Exchange, etc).

[nitwit005]

The pool is never truly limited though. Every industry was at one time tiny and had to train people to do the job.

But, training costs money, so they hope some other company will do it for them.