It feels like a chicken-egg problem. The actual consequences to the business aren't often serious, so it's difficult for them to get support to spend serious money on it.

Maybe mandatory high-cost, high-limit cyber insurance, with dramatically lower rates provided you can prove x/y/z, would make for an incentive?

Probably not. We can't even go after businesses when they do something that's clearly awful. Much less when the thing they most hurt is their bottom line.