Absolutely this. Many engineers simply lack security mindedness or secure development training. Similarly, many managers/PMs/etc have gaps here as well. Its

Absolutely this. Many engineers simply lack security mindedness or secure development training. Similarly, many managers/PMs/etc have gaps here as well. Its important for them to understand how to ask effective questions and prioritize security work accordingly. I've run into many stupid security mistakes, and continue to do so :(. Even though security can be very hard, as an industry we'd be way better off if more understood at least the basics. Those with interest/expertise can then dive in and find the more tricky things. Those without, can at least understand WHY these things are important.