Probably true, but you don't need to hire Matasano to tell you to patch your Wordpress. If you follow reasonable security practices then the low end automated s

Probably true, but you don't need to hire Matasano to tell you to patch your Wordpress. If you follow reasonable security practices then the low end automated scanning attacks tend to go away. Security of custom code is really another vector altogether and an expensive one that suddenly becomes important when your stuff gets popular enough to warrant bespoke attacks. I guess the problem startups may have is that they have lots of users (therefor lots of incentive to attack) before they necessarily have the spare change to pay for professional audits of their custom code.