Charles Kolodgy, an IDC security analyst, called Oracle's presentation on Wednesday "a little underwhelming," but said the message the company was trying to send is important.

"Many of their customers are not aware that Oracle has security offerings to help customers manage identity, data protection and compliance," Kolodgy said. "They have been know for building security into their products, but not for building security products."

However, despite the rosy picture Oracle paints about its past and future security strategy, it's something customers have traditionally been less than happy with, Kornbrust said. New products like Data Vault and Oracle Transparent Data Encryption -- which encrypts database data and stores the encryption keys in another location -- show the company is taking security more seriously, he said. But Oracle has a long way to go before it gets it right.

"They are not doing enough helping customers to make their database secure," Kornbrust said. "The patches are still ugly ... Selling new -- and expensive -- high-end features is good but doesn't raise the bar for the normal Oracle security. Most databases I see are vulnerable in most cases."

Still, said Kornbrust -- whose firm handles Oracle security exclusively -- those responsible for securing Oracle infrastructure "appreciate the direction Oracle is taking in the last month." However, it will take at least two to four years for most database administrators and developers to see results of the changes taking place now, he said.