Well, for one, don&#x27;t allow people to get masters degrees in security if they don&#x27;t know how to run ls.  Met a guy like that at my last place...<p>Next, hire more security people who just want to take things apart. There&#x27;s this weird culture around &quot;oh no, he&#x27;s a hacker&quot; that prevents legitimately curious people from getting into security. It stinks.<p>After that, realize that your federally mandated audits are bullshit. They don&#x27;t catch anything.<p>Then, hire a pentester to try his damnedest to break in. Forbid them from using paid-for tools and give them a chance to learn, but hire someone else afterwards if they&#x27;re not able to do the job. Yeah.<p>Once you&#x27;re done there, realize that your security is probably going to fail eventually, and just do the best you can with a good team of security experts and actually <i>listen to them</i>. Emphasis on the <i>fucking listen to them</i>.