I can't really fault the tech companies for this, it's not a great place to be in and there isn't an obvious solution. For all of the box ticking, theatrical d

I can't really fault the tech companies for this, it's not a great place to be in and there isn't an obvious solution. For all of the box ticking, theatrical diligence and audit-preparedness work I’ve had assigned to me in my Devops career, and bespoke security “services” and “products” out there that merely exist to enable more box ticking in the name of “security and compliance”, I think maybe we should start.