As a cybersecurity practitioner, regulation and oversight is the only incentive that moves the needle in my experience. If there are no costs or negative outcomes for not caring about security, security will not be prioritized. Big fan of SEC Breach Reporting via Form 8-K, as well as state reporting requirements.

https://www.sec.gov/newsroom/speeches-statements/gerding-cyb...

https://www.ncsl.org/technology-and-communication/security-b...