Security failures are caused by bad incentives, at least as often as by bad design. How can we fix the incentives? This is the economic approach to cybersecurity. Using large-scale incident and vulnerability data, we can discuss ways in which incentives can be improved in the fight against all kinds of threats: web compromise, malicious hosting, botnets, compromised IoT, IP spoofing.