Unfortunately, security is a cost center
Security is a cost center in the same way that insurance is a cost center. It is a current investment to reduce the risk and impact of future losses. No sane large business runs without insurance, yet plenty treat security as an after thought even though they serve almost the same function.
As a matter of fact I would predict insurance policies to require some security effort as a part of coverage fairly soon, since it could be argued that not securing your data is a form of negligence now a days.