Most organizations don't take security seriously. I work in the information security industry--primarily focused on healthcare security--and you'd be amazed an

Most organizations don't take security seriously. I work in the information security industry--primarily focused on healthcare security--and you'd be amazed and appalled at the lengths that CIOs will go to say that they "don't need to be HIPAA compliant." More and more, though--especially as high-profile incidents become more widely reported--security is starting to become an accepted norm. There's still not much budget for it, and it's still considered an inconvenience, but at least people recognize that spending some preventative dollars can save a significant amount in reactive responses (DFIR, legal fees, etc.). The HN crowd might be interested to know that the worst security offenders I've seen (even worse than old legacy systems) are software startups. Why? Slogans like "Ship First," or agile development cycles that don't include QA/security testing as part of a meaningful SDLC. What good is shipping something every two weeks, if one of those releases loses your customer database? My latest drive is to help organizations realize that security is a feature, not just an inconvenience. Once that idea is more commonly accepted, we'll all be better off.