We hire an external pentest firm once a year to tell us what to fix. Those changes are also inforced by updating our automated tests. I watch pull requests dili

We hire an external pentest firm once a year to tell us what to fix. Those changes are also inforced by updating our automated tests. I watch pull requests diligently to make sure juniors aren't creating SQL injections or more obscure security smells, or things that might cause the pentest firm to doc us points. I'm a regular dev. Anyways, what specifically are you suggesting?