I run a cybersecurity company that helps companies with exactly this type of thing.

So many companies we talk to simply say “yeah that’s not in the budget unless a customer/government tells us it’s mandatory.

About 10-20% do it anyway.

Hard to tell which is which as a customer.