It's not likely to change that until customers start to actually care about security. And by actually care, I mean start making purchasing decisions based on th

It's not likely to change that until customers start to actually care about security. And by actually care, I mean start making purchasing decisions based on that. Startups have limited resources, and that will never change. The nature of limited resources is to spend those resources on the tasks that will move the needle the most. Until security tasks start moving the needle, they'll get ignored. One way to make customers start caring about security? Regulation. In a very small startup with a serious shortage of resources, we're currently planning our GDPR compliance. And we're not doing it because we think privacy is important (though we do), we're doing it because customers are telling us that we need it before they can sign up. If customers aren't going to think security is important on their own (and they aren't), passing laws that force them to think it's important is the only way to change the situation.