One of my favorite authors is Marcus Wynne, who is CEO of a cognitive neuroscience firm. On his blog, he espoused: "There's this thing from psychology ... which is called, I think, "normalcy bias." In sum it's the thinking that goes like this: "It hasn't happened to me, therefore it cannot happen." It's a presupposition which provides an unconscious (as in you don't even know you know/believe it) foundation for action and planning. The cure for it generally is a harsh one, when reality sticks it's sometimes ugly nose in and says, "Hey Sweet Cheeks? Today's the day you get screwed."

I think about this in terms of cyber-security and disaster planning. No one wants to spend on it. (They don't like buying insurance either.) But when (not if anymore) disaster strikes in the form of outages, hacks, breaches, malware/ransomware, severe weather, floods, tornadoes, etc. many businesses are unprepared and fail.

Personally I don't know how to change someone's bias. It's like the worldview that on-premise hardware is better than cloud.