Like quality, security is a shared responsibility and requires education and work on the part of all users of a system. People must be educated in how to make reasonable security decisions and then be held responsible for their decisions. You expect mistakes and use them to refine your education, redefine your internal and external security procedures, and discipline the offenders. If someone makes a simple mistake, you pick them up, dust them off, and send them on their way, a little the worse for wear, but more aware of the consequences of the decisions they make. You have to quantify the efforts and costs so that managers and workers know the costs of security as a process and the cost of failures in that process.
Security is a shared task, just like the quality aspects of their job.
I know the comparison between quality and security, I have worked both areas, and there is no greater hostility than that of the programmer that has just been told that the bug that went out in the product was his responsibility, not mine. No, you're the one who was supposed to design it into the product in the first place. I remember reading recently that virus checkers on the PC are faced with a similar detection problem with respect to stealth viruses. One vendor claims that their virus detector simulates execution of the program that is being scanned to discover viruses as they unencrypt themselves. I'm not sure how they handle viruses that unencrypt on the third invokation or only on thursdays etc.