[Jiggly]

I'm not sure how I forgot to even consider cost - Especially as that's probably the main one lol. You're right!

It's easily overlooked.

Sadly, some entities who well and truly have funds to Implement changes, do not apply them due to complacency and the like.

"Sorry shareholder/major investor, we won't be upping your takeaway this month because we want to implement very expensive new security measures for an attack that hasn't happened yet."

You can see how it takes some convincing, but the convincing ought to win!