I did work at a major cable company building customer premises hardware about 5 years back (the only reason I'm sharing this story). They were alerted to a majo

I did work at a major cable company building customer premises hardware about 5 years back (the only reason I'm sharing this story). They were alerted to a major, easily exploited and REALLY stupid vulnerability in their system that exposed their core management network for the product to customers. They just hired the guy who reported it then fixed the problem 6 months later. The short-term mitigation was to put passwords on all their database servers (they were not there previously). Security was just not a concern until they had a major breach. The security teams had been screaming bloody murder for a while, but could not get the product teams to allocate sprint bandwidth to the massive, coordinated security hardening effort that needed to happen to prevent a potential headline in the New York Times.