Yep. This is generally true in business about a lot of things and especially in software because of the virtual nature of things it creates an incentive for peo

Yep. This is generally true in business about a lot of things and especially in software because of the virtual nature of things it creates an incentive for people to pretend things and inflate their claims so they get put in the same bucket as the big guys. That's how you end up with a weak site run by 2 people on a shared hosting with outdated software but they put up a polished home-page with "military-grade 256-bit encryption" on it and a lock icon and a chunk of people will not know better. I'm sure there's a proper term in economic theory for this concept someone can point out. No one says "security of our users is our 158th priority". However their behaviour very clearly shows it. They just want the benefits of a perception of security without actually putting in the effort. And when the chances of getting punished for it is low enough they can get away with it. This attitude also creates opportunity for a certain class of employees/contractors to shine. The type that does a very shallow job but claims that "everything is done". Business people love that and think that person is so smart and effective. Want backups? No problem he'll drop a single line in a cron file to generate unverified nightly backups sitting in /var/backups and says "I have taken care of backups." in 20 minutes. Chances are nothing goes wrong for years and he'll be the super efficient hero. But it's also possible that the business will suffer catastrophic data loss and finds out the true cost of their decisions. The person who wants to tackle the problem more deeply gets punished because they think he/she is too slow or makes things complicated. It can get pretty frustrating because what happens is you end up getting asked to achieve something and when you attempt to do it people will be like "no no no we didn't mean like that ... can't you just install a security plugin or something in there in an afternoon and move on to the next task?". So you will be forced to do it in a way that is not effective/full-proof and when things go bad you still have to take the blame because it was your responsibility. At some point I started calling people out on it.