It's sad that what Troy is arguing for sounds like the best we can expect right now and he is probably right. Ideally, there would be mandated processes for any

It's sad that what Troy is arguing for sounds like the best we can expect right now and he is probably right. Ideally, there would be mandated processes for any commercial company like any serious security vulnerability must be fixable within x hours/days (if a fix is available) i.e. the excuse can't be, "we don't have the means or money to fix that right now" and there are certain things that seem to be accepted knowledge in the security community (like password managers) that somehow are allowed to be circumvented by random companies because they decided so. The real question is why isn't there a mandated list of global best-practice for web app security that can direct any acceptance test of any web site? Can't people like isaca and isc2 agree something and make it the gold-standard?