No. The reality is that nobody cares about security unless it's their job to, so you have a handful of security people trying to get things fixed, meanwhile the

No. The reality is that nobody cares about security unless it's their job to, so you have a handful of security people trying to get things fixed, meanwhile the rest of the organization just sees you as a speedbump in the way of implementing new features or buying some new SaaS product. Devs where I work even went to my manager and asked if I could only be allowed to report security findings during specific timeframes because they get behind schedule when they have to fix things. We even have a document that lists a bunch of security controls to cover almost every situation imaginable, and most of the time the devs just say it's impossible to fix the vulnerability without breaking the feature, so they go to management and get a waiver for the security issue. Realistically, the only way for an organization to actually be secure is if it's part of the culture from the start.