average C(I)SO gets on his back that he simply cannot run the required security audits. Bluntly speaking, to get security up to par, the average corporation would at least have to double, more likely triple, its security staff. Security is a lip service business. Much like insurance. You do what law dictates, not a penny more is spent on it. If the law doesn't dictate that you have to be secure against SQL injections and DDoS attacks, it's mostly a matter of luck and whether the programmer writing the piece of software does it automatically, which in turn again is unlikely because it certainly is neither part of the testing nor of the final inspection protocol. Even if, there simply is no time for more than a cursory glance, so in effect the burden of blame is shifted on some scapegoat, most likely one of the CSOs underlings. Or, lacking said underlings, the CSO. Simple code reviews can find SQL injections quite easily. Just search for the method names for executing queries then make sure that there are NEVER string concatenations which include user input. It's all really quite simple. Use parameters for every query and you'll never have a problem with SQL injection unless the DB library itself has a hole (much less likely than the possibility that your home grown validation code has a hole in it). Compliance has nothing to do with security. Compliance has something to do with laws. Creating laws take time, creating auditing checkbox-ticker-tests