"Even Microsoft" is terribly wrong. In fact Microsoft is several years in advance to other software companies regarding security lifecycle of its products.

The early days fiasco are long gone and the SDL (http://www.microsoft.com/security/sdl/default.aspx) has performed really well.