A good security engineering function as an organization goes a long way. As does security engineering having a good relationship with dev teams. It starts with

A good security engineering function as an organization goes a long way. As does security engineering having a good relationship with dev teams. It starts with developers believing in security and knowing how to transform that belief into action with appropriate change agents. There is always a lot more than audits for places with good security practices and developers who deal well with frequent audits.