Train your ICs to be better at spotting risky behavior. They don't have to be able to exploit and fix the bugs: they just have to know when to ask for someone e

Train your ICs to be better at spotting risky behavior. They don't have to be able to exploit and fix the bugs: they just have to know when to ask for someone else to look at it. One thing we've found to be effective here: we start with a comprehensive audit (appsec, infrasec, corpsec, deployment security, external network footprint) that tells us about systemic problems you face. Then we can provide targeted training where you contextualize the problem for ICs. I'm sure Ryan McGee (magoo) has ways to tie that in to quantitatively making people better at risk estimates, but we're not trying to get ICs at clients to do that (yet).