> Professional security engineers do not, as a rule, encourage software engineers (or end users more generally) to... And many 'professional security engineers

> Professional security engineers do not, as a rule, encourage software engineers (or end users more generally) to... And many 'professional security engineers' ignore core security (e.g. auditing protocols, connections, user access, etc) to push AV software, 2fa tokens, NIDS, version/patchlevel compliance infrastructure, and other 'security tools', because this is easier and comes with 'vendor support'. I don't argue that these tools are a 'meme' however simply because there are a few people that don't understand the whole picture. I could just as easily argue: "The idea that most people can reliably identify security vulnerabilities in the systems they use just because it's protected by vulnerability scanning tools is laughable. They might find trivial low hanging fruit or obvious malicious activity, but they won't have a better picture of the overall security posture just because they can read the audit report."