> The security treadmill is hard for even the most modern tech companies to stay on. It's not hard. It just requires you to give a damn and actually treat it a

> The security treadmill is hard for even the most modern tech companies to stay on. It's not hard. It just requires you to give a damn and actually treat it as an important aspect of your process, rather than as an afterthought. And that's where most companies go wrong. > I think the infosec community could go a long way to helping itself by making easier to use tools, and writing canonical guides for common scenarios. That I can agree with, and behind the scenes, I've been arguing with infosec people about this for years now. But it's not an excuse not to get your security in order. If anything, that should be driving more investment from companies into security, to collectively produce more usable mechanisms and documentation... but that doesn't happen.