I’d beg to differ. Even in the silicon forest, I frequently come across firms with entirely dedicated Appsec and Infosec departments. Most dev shops out here ha

I’d beg to differ. Even in the silicon forest, I frequently come across firms with entirely dedicated Appsec and Infosec departments. Most dev shops out here have them and I’d be comfortable extrapolating that to SV and old money NY/CHI/LA and Austin based on my consulting experience. All of this is, of course, anecdotal but it’s a tad more than a blanket refutation.