I can confirm this is the case for my company. The software we produce can be classified as security software, yet nobody is trained in secure programming or ev

I can confirm this is the case for my company. The software we produce can be classified as security software, yet nobody is trained in secure programming or even basic security principles (e.g. validate all input, defense in-depth, etc). I'm by far the most security-minded developer on a team of about 20 developers, but everything I know is because I'm interested in the realm of security.