People in corporations say they value a lot of things. Actual value is expressed in expenditure of resources: that's time, attention and money.

Most companies are in a disaster recovery loop when it comes to security, something bad happens and:

1. There is a dollar investment in 'more security'.
2. C-level management/Boards express interest, ask for information.
3. Security leadership and team activities are elevated.

These activities reduce the 'bad happens', and the foot starts to come off the gas and all three areas slowly erode, it's a function of human nature.