Via new legislation (prompted by Angry expensive-Suited Mobs-with-Torches in DC, natch; not yer ordinary pissed-off Citizens, natch):
An independent clearing house is created. (Run by the Dutch, who appear to be taking the lead over our self-protecting Corporate System. Hey, they also beat us out on intelligent Drug management without filling the lowlands with new prisons - either.)
Each Week there is published (SomeWhere) a list of the previous week's reported exploits. Listed shall be:
Manufacturer of the software (including certain details of whether an ap, an OS or Other)
Running stats of Each-type exploit is appended each new report.
Use-in-the-Field data is shown - with brief resume of Mfg. of each OS, and a recap of the "repetitive factors" already ascertained for Mfg. overall, and for 'major' aps as have experienced 'insecurity in the past'.
"Cost in $$ per exploit" suggested.
OK, I've probably missed a couple featurez, but:
I think this just might do it, even when dumbed-down so that a Suit might sorta get: where the &^$&($ --> $$ are going. $$ they Do Get eventually; after all, it IS their God.
Ashton Final Solutions LLC