Security is the ultimate technical debt. Most companies get super deep into this kind of debt, it's just not visible until they "get unlucky". I think it would

Security is the ultimate technical debt. Most companies get super deep into this kind of debt, it's just not visible until they "get unlucky". I think it would be a good thing if companies, the industry, and everyday people were more aware of this concept (even if not with this terminology). I would guess that almost all companies have significant security deficiencies, which at least some of their engineers are aware of. It's just never a priority to work on, unless they've just been hacked. Their priority is always on product and marketing, and they have to compete with all the other companies not spending real engineering effort on security, after all. They're all just gambling on not being hacked to bad.