Cisco is a huge company.

I also worked there. It's... not good. Some of the development practices are nearly forced on every one no matter where in the company they work. I could write a book on how bad it is.

They might have a department somewhere thats doing great thing. But I never saw it. I did see a lot of bad ones though.

Size doesn't matter.

IE is made by a trillion dollar company but you can still find tons of security issues with IE.

I think the grandparent post isn't trying to say "a 100,000 employee company automatically makes secure software" but rather "anecdotal evidence from a year or two of personal experience may not be representative of a 100,000 employee company". Cisco has dozens (hundreds?) of global offices and is well known for growth-via-acquisition. There must be a million little micro-cultures in an organization that large, diverse and distributed.

> There must be a million little micro-cultures in an organization that large

There are, and in those, good code can be written. They're the exception. Source: worked there for 7 years.

That's kind of the problem - if you have a hundred little micro-cultures involved in a project, and 99 of these cultures value safety and one does not, then in the end you get an insecure product. A chain is as strong as its weakest link.