Many will justify it as we will be lucky to survive and grow to a point where a security incident will be a problem. AppSec is never the most important thing o

Many will justify it as we will be lucky to survive and grow to a point where a security incident will be a problem. AppSec is never the most important thing on any product manager or product owners list. No one says AppSec isn't important, just other things are more important. Sometimes the best you can do is talk them into letting the people that care dedicate some of their time to fixing security issues. While it seems bad, if this is a product or company you care about, working to make it better makes sense. You also might consider adding security concerns into requirements, acceptance criteria, and code reviews (if you have those) to stop it from getting worse.