I think for ordinary programmers, stories of failures might be more effective. Case studies, perhaps even a bit embellished to make them more compelling. Something along the lines of Kurzweil&#x27;s cuckoo&#x27;s egg. Except shorter and more recent.<p>I think what you&#x27;re getting at is a specific technology won&#x27;t save you, it&#x27;s the security mindset that&#x27;s needed. Convincing programmers there really are bad people who want to pick apart your systems is the problem. Once their convinced, once they take security seriously, they&#x27;ll do better.<p>They might start out doing a terrible job, but with the security mindset, they&#x27;ll improve. They&#x27;ll seek out problems and solve them. Rather than pretending it&#x27;s not an issue, or blindly apply security secret sauce like &quot;use bcrypt&quot;