Cryptography has always been largely driven by industrial mathematicians.

Elliptic curve cryptography spent years requiring commercial licenses because it was made practical by Certicom, who patented many of the core inventions.

A lot of the work on homomorphic encryption was done by mathematicians at IBM.

The DES standard was developed by IBM.

RC4, RC5 and RC6, some of the earliest stream ciphers, was a commercial secret because it was developed by Ron Rivest at RSA Security.

NTRU post-quantum crypto was developed as a commercial product from the start.

Many of the earliest cryptosystems were developed commercially, like Enigma and Crypto AG.

A lot of the crypto for mobile phone networks is/was commercial.

Academia did contribute to the early stages of public key cryptography both integer factorization based and elliptic curve based, but given the extensive history of commercial mathematics this stuff would almost certainly have been invented even if there was no academic mathematics at all.

> Progress is made by these people [...] Not by the industry.

Eh, debatable? Maybe a bit of both? Industry certainly brings research-level stuff to the masses. And has a way to winnow what's ultimately useful from the vast amounts of research that amounts to "huh, that's weird". And in turn that vast amount of stuff serves as the starting point, and round and round it goes. Research without industry would be pointless (from the masses perspective). And industry without research would be clueless or stagnant or outright dangerous.

Industry can also bring vast amounts of money into research. Just look at the field of Machine Learning.