If security costs money, and you get paid to make money, then security is not important until it's too late. I've seen my share of "security" executives for who

If security costs money, and you get paid to make money, then security is not important until it's too late. I've seen my share of "security" executives for whom actual security leadership consisted of dogs and ponies and lots of hand waving which was cheap and made them popular with the other execs. It's like being a general with no war around; then when you get a real war you find out the general has no clue how to fight a war.