> or in any case can’t easily reason about them given the resources available to most of the organizations running them. I really feel this. Any new piece of s

> or in any case can’t easily reason about them given the resources available to most of the organizations running them. I really feel this. Any new piece of software needs a level of ongoing maintenance that no one seems to realize, not even many software engineers I've worked with. You can't "just" toss a binary onto a VM and forget about it. But all the work required to secure that and keep it secure is so invisible to management. And because the work is invisible, it might even hamper career growth. So good luck getting either management or devs to prioritize all the security tasks they should be prioritizing.