Most developers are reluctant to take the responsibility in security and assume that this is the job of web administrators and network engineers. You may have best infra in terms of security but if your developers are not writing secure code your system...