> At some point we have to accept that 95% of companies do not take security seriously and decide what to do next. Perhaps we need an food hygiene rating for s

> At some point we have to accept that 95% of companies do not take security seriously and decide what to do next. Perhaps we need an food hygiene rating for software? Every year or two every piece of publicly facing software which deals with sensitive data should be audited for security by approved auditors. Failure to pass such an audit would give the company 6 months to address the issue or close the system to customers until the security issue is resolved. As part of this audit process companies could be given a "security score" which they would be required to display to their customers kind of how UK restaurants have to display their food hygiene rating to customers. Admittedly, I don't pay a huge amount of attention to a restaurant's hygiene rating, but the fact it's there at least gives me confidence that hygiene is being taken at somewhat seriously by any restaurant I visit. I don't feel the same about security on the majority of websites I visit.