Often what will happen in a large company is that security practices are strengthened in the short term, then people looking for cost cutting measures undo the changes a couple of years later, and the manager responsible might even get a bonus for improving the ops margin (hopefully transferring to another position before the next attack hits).