Comment by lateforwork

This should be law. Any company that is hacked should be required by law to make a sizeable investment in a third-party security research company.