There are really two problems that could go under the name of "fixing software security": (1) How do you improve the state of the art, so that, if a company is

There are really two problems that could go under the name of "fixing software security": (1) How do you improve the state of the art, so that, if a company is serious about security, they can succeed? (2) How do you fix the way companies are run so that they actually even try to take security seriously? Both are big contributors to the overall problem. I do think there is room for improvement in #1, so it's something we should be looking at. But we could get a lot of mileage out of #2 even if there were no way to move the needle on #1.