We have two issues here which are both bad. One, big corporates that don't take the appropriate steps because of incompetence, corporate inertia and a lack o

We have two issues here which are both bad. One, big corporates that don't take the appropriate steps because of incompetence, corporate inertia and a lack of consequences. People who say something are not taken seriously and the good ones leave. The other, has to do with startups, who are dealing with sensitive information, who do not take the appropriate steps to secure it because they would rather win the VC lottery. Putting customers data at risk is ok if they can get their payday. I have personally observed two startups that have done this. One was a startup working in the identity management and protection space logging sensitive information in plain text on their servers and bringing them down to unsecured local dev boxes for debugging. When I asked them about it they said they knew what they were doing was wrong but didn't feel like it was a big deal. From their point of view they didn't think they were a target. Of course they also didn't feel that it was worth the cost. The other was a banking startup that was storing Social Security Numbers and account details that would allow direct access to bank accounts on Heroku PostgreSql databases. Once again when I brought it to their attention, making the product look good for the next round of funding was more important than a customer having their bank account cleared out or having their identity stolen. Incidentally many of the developers for this banking application had come from a large established Accounting company and didn't seen anything wrong with what they were doing. What this really comes down to are ethics. Is it ethical to cut a corner and save money on development if it means that a data breach of our system could lead to possibly significant financial consequences to our customers? I personally try to adhere to the ACM code of ethics http://www.acm.org/about/code-of-ethics http://www.acm.org/about/code-of-ethics . But unlike the field of medicine where even the worst doctor has been vetted by a committee of professionals we have no bodies that evaluate the character of people in our field nor a oath like the Hippocratic oath that is an automatic piece of the training. If more engineers were willing to say no and even quit over poor security practices I'll bet you security would be taken more seriously.