+1 but with the addition that the people thinking about fraud/abuse/security are typically an isolated department that the standard product developer doesn’t ev

+1 but with the addition that the people thinking about fraud/abuse/security are typically an isolated department that the standard product developer doesn’t ever think about. For mature products/services, this is usually integrated, but for new products, they seem to first think in isolation and then consider the more pessimistic cases as a last minute check box item (assuming they’re part of a large, sophisticated company that has such a thing). I’m not disagreeing with the premise that people should be more aware, just explaining how I’ve seen it happen. People excited about bringing a cool thing to market often don’t have an answer to the question, “but what if a bad actor decides to use it for nefarious purposes?”