Equifax is not a monopoly. Furthermore, the root cause of this problem does not lie in any quasi-monopolistic feature of the industry. Appropriate regulation should not be ruled out, as a possible remedial action, on the basis of non-sequiturs.

Could argue that industries with low startup costs are much less likely to suffer a proliferation of Apache Struts. Increased competitive pressure to improve an information product might bring the side effect of more modern technology, but who knows the overall impact it would have on security.

Maybe, but the underlying problem is not a particular technology, or even technological in general; it lies in having a system built on false assumptions about the confidentiality of SSNs and other data.

Suppose we have a solution to the underlying problems. It would undoubtedly be difficult and costly for the financial industry to adopt it, and a startup that implements it will not be in a position to force its adoption. About the only thing that could would be regulation - but I'm not holding my breath.

From a single company's point of view, as an evolutionary entity , there is absolutely nothing better than becoming a monopoly.