The problem lies with management. Without their insistance and proper allocation of resources, security and education will not be a priority. Security costs $$$. Lack of security costs more. But try explaining that to the CFO or clients that only look at the immediate bottom line.