I think the challenge here is: if the users don&#x27;t care, why should the CEO of your company?<p>...and if the CEO doesn&#x27;t care, why is he going to want to pay developers to (as you say earlier) &quot;always include security robustness as a required feature during the software estimation cycle&quot;?<p>So, unless the users _do_ care, the only way I can see this happening is if it costs no more to the CEO&#x2F;users to do this than it costs not to... and that either means
*   all developers swearing your security &quot;Hippocratic oath&quot; (which, as you say, will never happen)
*   languages&#x2F;tooling that mean that this becomes automatic (where there have been steps forward, but we&#x27;re clearly not &quot;there&quot;, and I doubt ever will be).