What the author does not seem to grasp is security is fundamentally about managing risk. Consider his statement that "IT executives seem to break down into two categories: the 'early adopters' and the 'pause and thinkers.' Over the course of my career, I've noticed that dramatically fewer of the 'early adopters' build successful, secure, mission-critical systems." His measure of success is on whether or not the the software is secure and not whether or not it fills a valid need.

Consider two divisions within a large company. One is the research and development division and the other is finance. I want the R&D department to be the early adopters and I want them to take risks. They will be the early adopters. On the other hand, I want the finance department to be locked down.

Consider the same logic as applied to the typical startup. A startup that is focusing most of their time and energy on security is probably playing the wrong side of the risk equation. They have more to risk by delaying their product than they do making sure it is locked down. On the flip side, an established company like a bank or insurance company has a lot more to lose and should focus more on security.