Yet, we have been told that the free market alone may not be able to improve security sufficiently. The return on investment may be hard to prove, and businesses will only do what makes sense for the bottom line. We are generally skeptical of direct regulation and of government agencies grading the security of a private company, which is another form of regulation. Threats and practices change so quickly that government-imposed standards cannot keep up. Regulations can add to costs that ultimately come out of consumers’ pockets. .
