Bad software keeps cyber security companies in business