This touches on larger problems of compensation and reward even at the theory level. How do you attribute success at the organizational level to individual cont

This touches on larger problems of compensation and reward even at the theory level. How do you attribute success at the organizational level to individual contributions? Outside of things like annual contract value for salespeople or win shares for pro athletes, there is often a lot of remove between what any employee does and the outcome(s) the organization cares about. Stepping back from security, consider where else this kind of problem arises. I'm not going to remember who, but a decade back or so, one of the service branch secretaries said something to the effect that he'd rather reduce the rate at which servicemembers rape each other than win wars. Compliance with anti sexual harassment policies and contribution to positive culture became direct bullet points you had to meet on an officer evaluation report to get promoted. Is this right? I don't claim to know, personally, but consider the arguments. Nominally, what a military cares about is winning wars, but how much does what any individual officer does contribute to that? Throughout the Global War on Terror years, we regularly completely destroyed all of the leadership and fighting apparatus of elements in Iraq and Afghanistan that opposed US strategic goals. But we couldn't forcefully install competent local government with no loyalty to the prior regimes, and we couldn't eliminate sympathizers and supporters and even direct contributors to opposing efforts that took refuge in other countries the US military had no authority to operate in. In that sense, winning or losing was outside of the scope of what the military could even do. It was only one part of a larger national strategy that had many civilian pieces that could also fail. On the other hand, if they believed that reducing rape rates could promote long-term credibility and public image for the military and it was something that was actually under the military's own full control to do, then it arguably makes sense to place emphasis there. IT security is kind of like that. Software companies nominally care about profit above all else, or in reality scoring personal profit for their owners, whether or not that is because the company itself ever earns accounting profit. But how on earth do you assess the contribution of any individual developer to that outcome? We're looking here at people being promoted and rewarded based on quickly shipping features that seem to work and address some use case, but is that ultimately even what causes a company's owners to get wealthy? The company with the best software doesn't always win, and the company that wins doesn't even always make its owners the richest. Like reducing rape in the military, reducing security vulnerabilities in software is more of a social goal than an organizational goal. It's rare that it ultimately matters when companies have very large, very public breaches. It's a cost when it happens, but typically one that is drowned out by other considerations. Many large incumbents effectively can't fail over any short period of time of their own accord. They need to be outcompeted, and simply being more secure is not enough of a differentiator for users to switch. If we want to force companies to give a shit anyway and reward employees based on security, we need to make it matter to the organizations. Or you could better professionalize software development and make attention to security a matter of licensing, the same way you don't leave it up to financial advisors and attorneys to act in the best interests of their clients by organizational reward. You take away their ability to get a job at all if they don't do it, by means outside of the employers themselves. Ultimately, the military didn't really care about soldiers being raped until public outcry forced them to care. I don't think software companies are going to care, either, until public pressure hits some kind of breaking point, probably involving the force of government.