Which comes first : Compliance or Security?

Recently I was browsing through my linkedin profile and I see lot number of security professionals drawn towards this question:

What comes first Compliance or Security?

I have given a long thought on this question and I asked myself few more questions pertaining to the above question:

1> Can an organisation be secure without a compliance? Answer is reasonably simple yes.
2> does man secures himself or searches for compliance when in wild? obviously Security

on contrary I also asked myself questions to contradict above answers

1> How can an organisation find itself secure without a framework? a compliance is necessary
2> How can a large society function without a framework? yes its necessary.

But again I thought, let's bring it down to basics

1> what would I require to keep my data safe? security
2> how could I say that my data is safe in the current security? a compliance

Aha...so, I believe security must be build before we go for compliance or compliance auditing.
However, from above we can also conclude that security and compliance should complement each other to build a strong security and to strategize spending of limited budget.

Is finding first the new security trend?

I have been thinking about this for sometime now, if finding the vulnerability first is the new security trend?

After browsing through various public vulnerability exploit database, my answer to the question was simple to find.

First lets find a vendor whose application is vulnerable and check when exactly it was publicly available. Let's check IE

 Let's check when when it became public. Published on 24th of June2014.

 Let's now check when vendors in the market has released a patch for the same:

When was it exactly?

Cool, our customers are safe even before it was public!!!

(only if they have applied it in IPS policy....this makes me realize how many customers are really following these vulnerabilities and applying them timely. Or what if we can automate these new fixes based on policy they have applied. I am sure most vendor should have implemented long ago.)