There is a lack of market incentive for private cybersecurity much as there is a lack of market incentive for private fire stations or police departments. From a paper I wrote earlier this year:
This emphasis on expediency over security (when, in reality, both are attainable with careful design) is similar to Carr's description of how companies' commitment to cybersecurity is strictly a matter of revenue maximization relative to the perceived risk associated with being compromised. Marcus Willet’s recommendation that company boards establish a full-time security official to treat security “on par with legal and financial risk” is ineffective if security does not, itself, result in any financial or legal risk to the company. There are no strong incentives to implement a more robust design in the systems integrations with flight systems, nor to effectively prevent network intrusions. It would take legislation creating strong incentives for security and driving accountability to get corporate America's attention and investment.
Just as frontier defenders would have greatly benefitted from the ability to mass responding troops directly and instantly at the point of conflict, so too would the network defenders of today. The challenge, then, is developing a way to take advantage of that capability, the way the police respond to a break-in or the fire department responds to a fire, and make it available to private network operators in a way that creates incentives to take advantage of it. Network security is a public good just as houses not being on fire, or prevention and punishment of crime is a public good. We would do well to de-privatize aspects of it and develop a more coordinated response.