This is a very real problem. In my mind, the problem with security today is there is no convention over configuration. The current state of the art of vendors t

This is a very real problem. In my mind, the problem with security today is there is no convention over configuration. The current state of the art of vendors today is very much "here's a bigger gun, figure out how to defend yourself." Think back, in 2005, how Java and XML configuration vs Ruby on Rails -- convention over configuration was very much a big change in how we, as software developers, were thinking. We need something similar in the security space.