1.Many companies don't have dedicated security resources. If the choice is between adding security or getting a new feature out, most companies will choose the

1.Many companies don't have dedicated security resources. If the choice is between adding security or getting a new feature out, most companies will choose the new feature. 2. Security is a moving target so even if an application was made with best security standards, if it's not being actively maintained, new security attacks will get through. New 0-days come out on a regular basis 3. Security needs to be perfect or close to it. An attacker only needs to find one critical vulnerability or be able to tie together a handful of medium and lower-severity bugs