Security is bigger than finding and fixing bugs

I just wrapped up a post over on the SDL blog with some comments about an article on Google's security work.