‘There are three key drivers to get companies to change their behaviour: reputation, regulation and revenue,’ the e-safety commissioner says