> the way to have more hackers at scale is to grow every software engineer to be a security conscious engineer by default, such that they are constantly looking

> the way to have more hackers at scale is to grow every software engineer to be a security conscious engineer by default, such that they are constantly looking for vulnerabilities throughout development and deployments to production. Most companies I’ve worked for have encouraged this to a degree. However, there are some major objective mismatches when trying to fit security engineering into product engineering. It’s great to understand the OWASP top 10 and read up on basic issues to avoid (like SQL injection), but I don’t think this proposal is very realistic for a few reasons. Security engineering requires deep knowledge of protocols, networking, system design, etc. that a lot of product-oriented engineers just don’t have enough context to own that responsibility outright. New vulnerabilities are being researched on a regular basis. How do I keep up with netsec research while trying to stay current in my primary skill set? You might as well suggest to a front end dev that they should start rolling operating systems. On top of that, pen testing can be incredibly time-consuming, and putting that responsibility on engineers who are focused on shipping as quickly as possible is going to cause problems. My performance as a product engineer is tied to my ability to ship, not testing my feature against every known attack vector out there. We’re better off trying to change the culture of making everyone a half-assed security engineer by fostering a culture that treats security as a first class citizen.