>It's hard to describe the extent to which no one is even trying outside of Silicon Valley and very large corporations. As someone who has worked for multiple

>It's hard to describe the extent to which no one is even trying outside of Silicon Valley and very large corporations. As someone who has worked for multiple Silicon Valley companies and a couple of fairly large corporations, I think you are being overly optimistic about how much (on average) they are trying wrt/security. The actual processes tends to be: Put out something that coders with little sense of real security think seems kind of secure, wait to get hacked, fix attack vector, repeat. This process is probably not much different than the midwest places you are thinking about except for the fact that those places just aren't targeted as much because they aren't sexy targets so the release->hack->fix cycle never gets churning fully.