yeah, except that in practice, alot of "fast development" happens on platforms where engineers ignore updates that aren't explicitly flagged as security because

yeah, except that in practice, alot of "fast development" happens on platforms where engineers ignore updates that aren't explicitly flagged as security because the want a stable environment, then when the security bug hits, they push back on deploying the security fix because of breaking functional and API changes in the dependency. I have worked in a broad range of orgs from start-ups with 4 people to government, fin-tech, and bay area tech companies and every single one has had the same stumbling block that has been a pain in my ass as a person responsible for assessing and helping engineers ship secure software.