For the rare company seriously interested in security, a way to reward it might be occasional audits on the work of some randomly picked employee The audits wo

For the rare company seriously interested in security, a way to reward it might be occasional audits on the work of some randomly picked employee The audits would grade the work in comparison to the company's accepted level of security, and for those which fall below measures are taken, while for those above there's an unbounded, significant bonus, higher the better the security practices of the employee. A company might also set a upper limit for unapproved, revenue-affecting practices, of course