I suppose if a software developer wishes to secure a small number of their applications, they can. But they cannot wait indefinitely for a guru equal to the guru dispatched by one of the boutique application security firms to start application security. And the biggest reason for this is because these gurus are extremely hard to find. The boutique application security firms themselves wait years to find one to hire. That's right! There are no schools. They very mistakenly think the guru must be self-made. So, for the application security do it yourself community, you must either hire a mere mortal who can attain expertise with experience and training or you will remain on the tarmac indefinitely and not get application security down the runway and off the ground. .And that won't do because the bad guys aren't putting off their plans to hit your critical data until you find your guru making it a fair fight. And compliance laws such as HIPAA cannot be ignored or misinterpreted for long. In other words, you better get moving on application security with the best personnel you can get your hands on. Don’t worry, your software will be secured to a level that is worthy of deployment and your firm’s application security will get better and better.