FWIW: I spent about a decade in application performance consulting...my own experience was that most companies only care about performance when it is costing th

FWIW: I spent about a decade in application performance consulting...my own experience was that most companies only care about performance when it is costing them obvious, painful money, and even then they care just long enough to duct tape the problem and move on. I probably should write a book about my experiences because many of them show the psychosis of corporations. My point here though is that it can be a challenge field to market yourself, because there is a tendency to only make an investment when there is an emergency, rather than taking preventative steps. Once you fix the immediate problem, one would assume the client would want to insure the problem never happens again and to take remediation steps to look for other issues. Instead, my experience is that most simply do nothing until the next emergency. From what I hear, people who are security experts go through a similar customer lifecycle. All that said - I worked on lots of interesting stuff during that time and it was the most enjoyable technical work of my career.