It is a culture problem, and worse than that -- it's a talent problem. Everyone knows that the world wants and needs ten times as many talented coders as are a

It is a culture problem, and worse than that -- it's a talent problem. Everyone knows that the world wants and needs ten times as many talented coders as are available, and the vast majority of the time, it just has to get by with untalented ones. In cyber security, the problem is far worse. I would believe if the demand were a hundred times the supply. Big, important, sexy-on-a-resume organizations have a hard time getting enough cyber security talent to be actually effective. God help people who process meat or transport oil for a living. My guess is that the reason it's a culture problem is that it's a talent problem. Some big, scary thing that no one knows how to effectively solve is going to result in everyone working to avoid blame rather than solve the problem. And organizations that have to get by with extremely bottom feeder security talent wind up with extremely bottom feeder security knowhow, processes, and intuition. If you can figure out a way to effectively productize defensive security, that seems to me like a great way to print money. Unfortunately, the problem is that your customers are not good at thinking about security and can't afford to be (and are distracted by trying to solve their actual business problems), and your adversaries are extremely resourceful, persistent, and motivated. Even when great tools are out there, people often fail to use them or break the security in some silly way. For example, in theory, keeping systems patched is a solved problem -- use one of the automated patch managers out there. In practice, doing so correctly is a pretty tall order for a lot of people, and isn't actually easier than creating and carefully following an effective manual procedure. And in actual practice, the problem never was putting in the effort to get to the systems and run the updates, and it never was setting up a patch manager -- organizations getting caught by these common CVEs often do neither. The problem all along was knowing that patching is important important, not just one of a hundred security checkboxes that you'll never check all of. I really don't know how you would productize that. (And in actual actual practice, sometimes patch managers get hacked. Most meaningful security problems sound stupid but are actually hard.) There have been many efforts over the years at making security idiot-proof in some domain or another, some more successful than others. If you see an angle, I very much encourage you to go for it. Just remember to test your solution on quality idiots. And remember that you are competing with charlatans to sell real medicine to idiots.