It's not an attitude, it's my experience: the infosec teams are deputized to make assertions they aren't qualified to make. Most of the time they're the inten

It's not an attitude, it's my experience: the infosec teams are deputized to make assertions they aren't qualified to make. Most of the time they're the intended bridge between legalese/contracts/regulations and technology reality. The good ones do this creatively. The shitty ones do this blindly or perhaps bureaucratically, in the context here. I've borne witness to infosec people so hands off I'm convinced they secretly have two jobs as remote workers. Good DevOps and dev folks obviate infosec, leaving the latter roles to industries that mandate it.