Huh but that is the job of security auditor to assess risk level give report with level of threat and then product owner job is to take responsibility for imple

Huh but that is the job of security auditor to assess risk level give report with level of threat and then product owner job is to take responsibility for implementing fixes based on that report. I do not understand way of working where you have security team that dumps report with bs on developers heads and say fix all now or we die.