@boblord I don't think it's about the learning (you are right of course, there is much to learn)

We have no incentives at the moment

Secure by design needs some secure by incentives