Comment by pjmlp

The only way to make it part of the original requirements and not an afterthought is to start making it like in other industries.

Exemplary punishment for any security exploit gone wild.

Management will start getting the required resources to make it happen accordingly.