Sorry consumers, companies have little incentive to invest in better cybersecurity