[zardo]

>(I realize this might be hard to do given the reality of security these days, so there would need to be some nuance of course)

In my industry, the EPA produces technology forcing regulation, we will have to invest a few hundred million to meet the upcoming standards and continue selling our product in the US after 2020. To sell our product in 2027, we need technology that hasn't been commercialized yet.

Maybe computer security could use a technology forcing regulation to get real investment in secure software to happen.