From the top down, executives need to communicate that it is a company priority. Even better if they can make it a cultural thing, instead of an afterthought. A

From the top down, executives need to communicate that it is a company priority. Even better if they can make it a cultural thing, instead of an afterthought. A lot of the time, engineers just don't know best security practices or in the case of web development, common exploits[0]. For middle management and below, if upper management doesn't care about security, despite the "look at Yahoo" argument, then you'll find no leverage there for security funding. If they care at all, then managers and individual contributors can argue for security to stand out and accelerate their career. Yahoo's security troubles brighten the spotlight on the need for security funding at companies for training, audits, and setting aside time to do retroactive security work. It's not a silver bullet, but it helps. [0] OWASP has a lot of great web security resources. Here is their top 10 list from 2013, https://www.owasp.org/index.php/OWASP_Top_Ten_Cheat_Sheet https://www.owasp.org/index.php/OWASP_Top_Ten_Cheat_Sheet