I have the same experience. But they are usually not willing to invest until they are hacked and even then. It is like the article yesterday on HN ; correctness & security are nice, but almost always not in the budget. Even when the result could be far larger losses. It is the 'could be' that prevents almost the entire world from doing something about it as for most systems it doesn't happen even though it very easily could happen at any time. Like the example from this blogpost.