Any approach to addressing security that doesn't take into account human nature is bound to fail. I have seen too many security-minded people fall back onto "well they shouldn't...

I like your point on vendor training versus the analogy of doctors training with other doctors, legal CE, etc. The equivalent that comes to mind is the Google-style devotion...

Perfectly said.

In two words - regression testing.

It is a costly endeavor, even for those systems that aren't considered "regulated".