That's true but irrelevant. Giant 150+ person body shops do win most of the work, but they don't win the best work; the best work is bought for people who can't afford to blow a release cycle because a scanner jockey screwed up.
If the State of Utah Public Pension Department's Gigantic Software Consulting Vendor wants to farm out those 900-page mainframe-style J2EE shitshows to [GIANT SECURITY VENDOR], I'm just fine with that.
Nobody in this field is big enough to deliver all the work. Software security is delivery-constrained. You can be selective about your clients. Be happy about that, and don't worry about the shitty projects body shops are selling.
If the State of Utah Public Pension Department's Gigantic Software Consulting Vendor wants to farm out those 900-page mainframe-style J2EE shitshows to [GIANT SECURITY VENDOR], I'm just fine with that.
Nobody in this field is big enough to deliver all the work. Software security is delivery-constrained. You can be selective about your clients. Be happy about that, and don't worry about the shitty projects body shops are selling.