> the people making the decisions know they need computer security, but they can't tell the difference between real computer security and security theater. Hit

> the people making the decisions know they need computer security, but they can't tell the difference between real computer security and security theater. Hit the nail on the head. Also real security being something you do rather than something you can buy is a big thing, these people think you can buy your way out properly understanding and designing systems. Vendors have taught them to think this way across all software (not just security) so it's hard to blame them but it does make this very hard to fix.