> I'm lost; what specifically is not the point? That there is an organizational issue. Of course there is an organizational issue. There will always be organiz

> I'm lost; what specifically is not the point? That there is an organizational issue. Of course there is an organizational issue. There will always be organizational issues. > Or explain why 20+ person-years of engineering time wasted isn't a symptom of broken corporate structure? Oh, it's definitely an organizational issue here, that's just not the main point. If you're willing to call this a "broken corporate structure," then you should revise your opinion of every company with more than 50 employees downward sharply. This is a normal corporate structure, not a broken one. > Could you explain how company size and broken corporate structure are correlated? When there are enough people, you will always end up with conflicting incentives somewhere. A larger organization will have more of these. In this case, it seems to be a clear case of competing priorities: IT wants to secure systems, and developers want to be maximally productive. I'm sure some folks in IT view Amazon paying ~$7M as a fair cost to remove known vulnerable tools from their infrastructure.