I don't think that's an exception. It's just that encryption isn't actually core functionality for most businesses (even some that think it is). And if it is

I don't think that's an exception. It's just that encryption isn't actually core functionality for most businesses (even some that think it is). And if it is core functionality, you should have staff qualified to roll their own, and you should all know why you are doing this (i.e. what differentiation you are going after). This really isn't limited to encryption, it's just a hard domain that bumps up against a lot of other domains, so you see more failures than some others. Basically if you are going to build a startup or new program in a hard domain, you need to have the resources to do it properly, and you need to know what those are before you start. This is where being a team of smart and motivated individuals may just not be enough.