I've heard serious suggestions floated for a tax and contribution funded pentesting agency that helps companies without waiting for the first breach. But I think the scale of it all is just a bit much.