Sidenote: > "We take X seriously" therefore there are no problems with X. This is my favorite response doing Tech DDs. I meet execs who say "we take security

Sidenote: > "We take X seriously" therefore there are no problems with X. This is my favorite response doing Tech DDs. I meet execs who say "we take security seriously" all of the time. I enjoy the follow-on of "ok show us then"... Do you backup your DB? Do you test it? No? Do you encrypt everything at rest? No? Are you using MFA for all services that are accessible by developers? No? etc. etc. Then no, you don't take security seriously.