They aren't joking. How? Because they went out of their way to hire very good appsec people to build their team. There's a geography and right-place right-time element to what they did, too.

They're a pretty good case study for how the right senior hires at the right time can set the tone for a security organization for many years after those people leave.