This field is ripe for security consulting firms, but they seem completely uninterested. Weird.