Zoom's problems aren't really a matter of having security talent, they're a matter of the company as a whole not prioritizing security. Fixing the former doesn'

Zoom's problems aren't really a matter of having security talent, they're a matter of the company as a whole not prioritizing security. Fixing the former doesn't fix the problem, it just makes for good PR. The latter is a requirement for the former. Brian Krebs talked about this a bit in the wake of Equifax: https://krebsonsecurity.com/2018/12/a-chief-security-concern-for-executive-teams/ https://krebsonsecurity.com/2018/12/a-chief-security-concern... Assuming Zoom is really trying to fix the problem, it makes a lot of sense to bring in management (and/or teams) who have experience with bringing security into engineering culture, as opposed to individual security experts who may not even want to work for Zoom in the first place.