I've been involved in security for the Banking industry for 5 years now and before that I created and developed the Network Security Technology at Texas State Technical College in Waco, TX back in 2000. Prior to that I worried about security measures for the largest trucking company in North America, a major law firm, and a printing company.
I've started with 8088's to current server technology. I've seen lots of OS's, software, hardware, security technologies, etc... and one thing remains constant; Layers 8 & 9 of the OSI model control the other 7 levels in security.
Level 8: Politics
Level 9: Money
Without Levels 8 & 9 the other 7 don't mean anything. I have personally seen companies spending more time evading auditors questions than correcting the problem. So the status quo still applies even after all these years.