I agreed your point of view. Information Security can get better. However, the main concern is the communication between IT members are always problem.

Information security is not only talking to the architechure and technology, but also the team work between IT members. The freamwork of ITIL and Cobit give a very clear details on the job role of any aspects. To effectively to use it, you need communication, this communication is not talking about the technology but about people. Lots of businesses and enterprises focus on how much budget putting into technology to making better ISec enviroment. But so far, not much of them are investing on the training of teamwork.

Thats a valid point on communication and it possibly starts at the top where a strategy isnt documented so no-one else knows what the strategy is.  From that point onwards you have disparate goals and targets and then people start doing their own thing.
I think also though your point could include attentiont p processes.  A technology is often invested in as you say, and i think then management often forget to actually put some processes in arpoun dit.  For instance when a new firewall is set up , very soon a barrage of rules exist and no-one knows why - they are not documented, no processes are put in place to add or repeal rules and no communication about the firewall and its rules take place.  Very soon there is a security hole from the implmentation of a security solution! 

I would bring this back to my original points though that CIOs are often not up to the job and techies need to have a bit more security focus and training.