[TheMightyLlama]

One of the major issues I've seen while working with large organisation on software development is one of mindset. These are organisations who predominantly think: "We are an 'x' organisation that happens to develop software". The more productive and safer way of thinking is: "We are a software development organisation that is within 'x' market".

However, the latter requires a huge mindset and experience shift from the very top of the organisation. And groups and individuals of that organisation having strong interest in their survivability are, of course, not going to change that.

[galangalalgol]

What if software development isn't the most technically challenging aspect of their operation? Say spaceX or a nuclear physics lab?

[cgrealy]

Or healthcare?

[galangalalgol]

That too. Although if they are making medical equipment, software (if you include the algorithms, which you should) is probably their main challenge. Everyone is not a software development company, but I agree security is every developers responsibility.