This is the real issue. We can hire all the "security experts" in the world, but if software and architecture are fatally flawed from the getgo, you can check

This is the real issue. We can hire all the "security experts" in the world, but if software and architecture are fatally flawed from the getgo, you can check all the checkboxes, and scan and produce all the pretty reports you want. The end result is still paper mache