The value of information
Most businesses aren't as enthusiastic about using information security technologies as many security experts would like them to be. As a general rule, businesses tend to make informed decisions, so maybe there's a reason for this lack of enthusiasm. A recent meeting at which I was the only non-economist in the room gave me an interesting insight into this, at least for some industries.
According to the economists at this meeting, the consensus of lots of research is that the value of information is only about 1 percent of the value of the finished product that it's used to create. So if you make widgets that you sell for $1 each, then all of your business' information is worth about only $0.01 of that $1. If that's the case, then we would certainly expect a fairly small level of resources to be allocated to protecting its confidentiality, integrity and availability.
I would expect that estimate of 1 percent to vary a lot from industry to industry. Some day, when I actually have some free time, I may track down some of the economics papers that make that estimate to see if my suspicion is right.