I am not sure if corporate leaders really consider this that seriously. They are more worried about the short-term. Asking them to re-invest money to insource just hurts their quarterly and annual financial statements. My guess is that top level execs figure if something bad happens, they may get fired but they will leave with a nice payout and move on to some other company. Their pitch is always, I reduced costs and raised quarterly returns. Sadly, information security and cyber-security are seen as cost centers and things you have to do. It is not a business priority. How I wish it was though.

All the guy did was tell the truth. One day maybe the world will get over believing in something created by folks attempting to explain the world around them. Doubtful in a few hundred lifetimes, but we can dream.

Check with your school's Technology Transfer group. While it is true that Universities generally want control over everything created while you are working for them, most of the time the value to the University is not worth their time or trouble. If your work will generate actual revenue for the University (revenue that will actually offset the work involved in licensing and all that), they'll be very interested. If not, they will most likely leave it up to you to do with it what you will. At least that is how it works at my school.