Agreed. The cross pollination required to get security into organisations correctly isn't there. Orgs see security as a pain in the ass, and not an investment/insurance policy.

I feel your pain in those latter points.