[BugBrother]

I believe it is painful in high security organizations, by definition. You can often e.g. only use tools which are vetted and stamped OK by a complex and expensive process -- so they are old.

Imho, security is really interesting theoretically, but probably not to work with outside of the academic world.