We live in a world where if you have an online presence you need to keep on top of all security patches. You need to do penetration testing. You need to practic

We live in a world where if you have an online presence you need to keep on top of all security patches. You need to do penetration testing. You need to practice secure coding practices. In my experience, often at larger companies you have to fight to make sure that everyone in the organization understands how important security is and to make sure that it gets prioritized properly. It's not about the security issue in particular, it's about an organization that didn't have proper security practices. This wasn't an unknown security issue, it was a reported and fixed issue. (Also, they were using Struts, not Spring.)