Comment by blooalien
16 hours ago
The people who should be held liable never will be. Their money is like an impenetrable shield to any sort of accountability. They'll just scapegoat the guy that warned them about the risk repeatedly for not doing more to prevent it.
It has to start somewhere, even if imperfect.
I have been in meetings were the Data Security Officer refused to sign off on specific projects, without having a proper pentesting report in place, for example.
Because legally it would be their responsibility, if something would happen.