The transition to better security? It's been almost 20 years since the Code Red worm. How much longer should we wait?

I think the transition to better security will go faster if companies know they can't buy their way out of the problem.