This is a timely piece for me after seeing and hearing thoughts from the YC side[0] and the practitioner side[1]. I'm of the belief that many security issues can't be innovated away like a stereotypical startup is funded to solve. There aren't any "products" to sell when many of the problems lie with the decision making processes at insecure organizations.
[0]: https://twitter.com/sama/status/618883756774916096
[1]: http://www.cigital.com/silver-bullet/show-111/