"But the real problem for companies lies in the practice of using out-of-the-box programs to protect data."<p>No, no, no, no, no. The real problem lies in either rolling your own, or using out of date out-of-the-box programs. When it comes to cryptography the only way to do it (unless you're hiring a cryptographer) is to use an out-of-the-box program that's up to date.