Are We Spending Too Much On Cybersecurity When Costs, Reputation Risks & Fines Are So Small? So, how bad are breaches, really? Do you think that part of the reason why cybersecurity is underfunded is because of liability? Do breaches have manageable consequences? Is a breach a game-changer for a company? Or is something else going on? To spend or "underspend":  that is the question.