If you believe any part of innovation comes from new products launched by small new companies, then regulation <i>will</i> hurt security, because to a first approximation none of those kinds of companies have any coherent plan for software security. None of them can afford market rates for this kind of work.<p>Another problem with regulating software security is that it will inevitably involve licensing software security assessors (it&#x27;s hard to meaningfully require audits without doing that). The history of licensed security auditors is not reassuring; the economics predict a race-to-the-bottom, and that&#x27;s what you get (see: PCI).