At a certain level, you can't fix stupid This, and laziness in the name of avoiding friction and remaining competitive. In every size organization I have been

At a certain level, you can't fix stupid This, and laziness in the name of avoiding friction and remaining competitive. In every size organization I have been in the customer code will be audited by third parties. I have never seen internal automation audited by third parties. Not in banks or financial institutions. I've worked for both big banks and small financial institutions that grew into big ones. People get spread thin and fight to maintain control of the systems and code they are responsible for and this is only getting worse with time in my experience. With time more command and control systems are spread out and inter-connected with on-prem and cloud solutions that delegate root privs to third parties running entirely closed source code with very little consequences for damages. Infosec and security orgs apply very outdated logic that would not even stop an amateur attacker. If you were able to do that, someone (probably multiple people) weren't doing their jobs. By design these jobs do not exist at least not in a meaningful manor. People validate change tickets. People validate that code does what it says it does but that's where they usually stop. Security organizations these days are being moved under the same orgs that manage code to reduce friction. This stops Security Theater which is indeed a real problem but it also curtails people going down rabbit holes. Close ticket, move onto other issues, don't block a team from getting work done. Don't like what someone is trying to implement? No problem, design a better solution. For 8000+ developers? Yeah nobody scales like that. People review individual code snippets. People stopped looking at big pictures of implementations. Disasters like Solar Winds don't happen because of one piece of nefarious code. They happen because a broken framework of thousands of pieces of poorly thought out code are glued together. There comes a point where the junk-yard of automation gets so big and ugly that even if leaders wanted to overhaul it they could not and if something nefarious was occurring nobody would see it, probably not even for a long time after damages were done. It's next to impossible to reverse engineer junk-yard automation which is what most automation becomes with time.