Low Risk of Big Consequences
I mainly do earthquake risk, and this is sort of the same thing. Would you upgrade your building in California? Nobody expects anything to happen, and the government will fix it all anyway. IT risk should be insured, like earthquakes, and the more you do, the less the cost. But big trouble trying to quantify it.