perhaps the question should be: why don’t investors allocate funds for secure software?