My view is that any non-trivial project should have explicit non-functional requirements relating to security (amongst others). Almost none do. Creation of thos

My view is that any non-trivial project should have explicit non-functional requirements relating to security (amongst others). Almost none do. Creation of those written requirements, and ensuring they are fulfilled, requires the use of security experts. Sadly, most IT project management have no understanding of this. It seems that a successful project has become one that is "satisfactory" to stakeholders. Security and compliance and other non-functional requirements too often are just afterthoughts.