Security is a discrete objective with a distinct success / failure metric. "Responsible innovation" is not discrete. In simplest terms, one can judge if secur

Security is a discrete objective with a distinct success / failure metric. "Responsible innovation" is not discrete. In simplest terms, one can judge if security is succeeding with a security audit. Either access is avaiable to the right parties, or not. One cannot say with certainty if one is being a responsible innovator. If your products are great bc they are are built quickly on top of a swiss cheese security policy, the security team is à blocker (or at worst, a delayer) of the company bankruptcy from fraud/fines/asset loss. If responsible innovation is blocking product, its not certain what (if any consequences) there will be if the product is unblocked. Therein lies the problem