It's all fun and games until your next whale of a customer asks for your SOC report. Then the auditors are asking you to prove you've audited your code and depe

It's all fun and games until your next whale of a customer asks for your SOC report. Then the auditors are asking you to prove you've audited your code and dependencies. They ask "who has access to customer data? Who can deploy code? What about your perimeter security and intrusion detection? Are you running virus scanners on all of your servers?" Then you realize it's easier to have a complex deploy pipeline that does all this stuff that isn't just writing your app for you. And containers are a decent enough way to abstract your app away from all the cruft. I guess the answer is don't write enterprise software?