Anything that can create the proper incentives for keeping code at all levels secure enough. (Indeed, perhaps open source is the only realistic one, for newly w

Anything that can create the proper incentives for keeping code at all levels secure enough. (Indeed, perhaps open source is the only realistic one, for newly written code at least). Because yes, it seems the problem is with incentives. If attacks on such things happen seldom enough, that will never trickle down into incentives for managers at all levels to prioritize security high enough. Then, somebody could argue that if it happens seldom enough, that is reason to not prioritize it that highly. But I don't think the actual risk translates into actual incentives for managers in a very linear, nor fact-based manner, especially when the number of occurances is very low, while still with catastrophic consequences.