One of the root causes seems to be that everyone with the aptitude for security crowds toward jobs that don&#x27;t actually involve implementing good security.  It&#x27;s not as fun to be a developer that is really into security but only have that be part of your job.  Even if it&#x27;s all you do, if your days are just &quot;analyze, document, harden, repeat,&quot; that&#x27;s a lot less fun than getting paid to pop boxes.  I know, because that&#x27;s what I do.<p>That disinterest is the entire raison d&#x27;etre of I am The Cavalry.  From their webpage:<p><pre><code>    No one is rising to meet these challenges. The cavalry 
    isn’t coming. We are the domain experts and we are the 
    adults in the room. It falls to us. We Are The Cavalry.
</code></pre>
The less-charitable interpretation of this is &quot;Hey dummies! If we all want to play red-team, who the fuck do we think is left over to fix things?&quot;<p>I went to a two-hour presentation at $serious_security_conference on $my_product_domain.  I was really excited to see what there was for us. We&#x27;re not running webapps on racked pizza boxes, so there is a lot of topics in our systems that aren&#x27;t really explored in public security literature.  Instead all I got was some dummy thinking he&#x27;s hot shit because he found some vulnerable systems on Shodan.  I got angry enough to walk out, and then went back thinking there was probably some value to be had.  3 times.