I'm currently in YC startupschool with a security startup, here's what I think is the problem: security doesn't scale easily on the marketing side. For most businesses security equals costs, and no quantifiable savings.

Most business don't have budget allocated at all for security. Big corps are the exception, but then you'll have the trust issue: they are unlikely to do business with startups when it comes to security.

I have also found that it's hard to find security experts who are willing to work for a startup. Given the salary options that security techs can get at big-corp/government/military, it's hard to be able to compete.