Well, the entire purpose of the infosec industry is to cover for the sh*t practices in the software development industry (and no it ain't engineering what most

Well, the entire purpose of the infosec industry is to cover for the sh*t practices in the software development industry (and no it ain't engineering what most of these people practice). So you have to expect that if your vendor is CADT your security is going to be full of holes and undiscovered bugs, critical missing features/etc. Move fast and break things also means shed-loads of bugs, many of which could be exploited by an enterprising individual for gain.