Hewlett-Packard's John Diamant points out most enterprises invest little in the area with the greatest vulnerabilities: application security.