The first thing I do when I read a news article that includes any company or organization saying that they are 'serious about security' is go to their website and check their job listings. Sometimes they have openings for security-related positions, but what is actually telling is their software openings. They NEVER so much as mention a single thing about security or knowing how to create secure applications. I've literally not seen a single exception, personally. Most companies do seem to have reached a level of 'caring about security' but it amounts to hiring some people to play Patch Patrol and nothing more. I guess that's better than nothing, but it won't actually help much.