In my opinion security, devops and all other teams have common goal. Namely help company to create sellable product. Being insecure and undeployable are both fa

In my opinion security, devops and all other teams have common goal. Namely help company to create sellable product. Being insecure and undeployable are both fatal flaws working against this goal. Sadly, as any specialized department, security tends to loose this perspective and pursue own goals e.g. emulate external auditors, instead teaching the rest how to work with them efficiently or enforce whatever new shiny security standard is, without consideration of fit and impact. Of course the same problem can happen, when devops install k8s to support two instances of blogs or developers incorporate DDD into creation of simple CRUDs. My company is currently working as a vendor for customers in highly regulated area. Customers have own IT, however they are unable to do anything meaningful in reasonable time, because of completely over the top constraints put on the developers (definitely bigger than required by regulators and not well thought). What's funny the more customers are happy with our work, the more their security pushes us to adopt their own standards. Then our security tends to support them because they are clearly "superior" to us (namely more tight). Clear case of ceasing to cooperate and focusing on own area.