This reminds me of the shifts in focus we have seen in other areas such as industrial control systems, manufacturing, and others. Same story - little focus on security, a threat is seen at a few locations, execs in the same industry start asking questions, and now focus is on improving security quickly.

Too often a tactical approach is followed where a technology-only solution is taken to FIX the problem, whereas a strategic approach (like you recommended) is a much better outcome as you can ensure the higher risk items are attended to first and the organisation gets the best risk reduction / dollar spent, rather than the newest shiny panacea. Shiny boxes are not much good unless you have well integrated processes and the right people to get the value out of them.