You pay them a million per year, and fire them when a breach happens.
Way cheaper than improving security.