What I found helps the most, is to have frameworks that make implementing secure code hard. XSS is much more rare now that most people use Angular or React (plugins can be trouble tough).