Industry Perspectives: Lessons learned on taking security