This is a timely piece for me after seeing and hearing thoughts from the YC side[0] and the practitioner side[1]. I'm of the belief that many security issues can't be innovated away like a stereotypical startup is funded to solve. There aren't any "products" to sell when many of the problems lie with the decision making processes at insecure organizations.