I think the challenge here is: if the users don't care, why should the CEO of your company? ...and if the CEO doesn't care, why is he going to want to pay deve

I think the challenge here is: if the users don't care, why should the CEO of your company? ...and if the CEO doesn't care, why is he going to want to pay developers to (as you say earlier) "always include security robustness as a required feature during the software estimation cycle"? So, unless the users _do_ care, the only way I can see this happening is if it costs no more to the CEO/users to do this than it costs not to... and that either means * all developers swearing your security "Hippocratic oath" (which, as you say, will never happen) * languages/tooling that mean that this becomes automatic (where there have been steps forward, but we're clearly not "there", and I doubt ever will be).