You have the right level of cynicism, but you should instead direct it at the field of DevSecOps as a whole. 98% of "SecOps" is utterly pointless boxchecking f

You have the right level of cynicism, but you should instead direct it at the field of DevSecOps as a whole. 98% of "SecOps" is utterly pointless boxchecking for ass-covering security certifications which waste immense amounts of time and enforce nothing meaningful. You could ABSOLUTELY 10x workflow efficiency there by plumbing the codebase for questions like: "What are all the OSS libraries you use, and the licenses?" "What's your test coverage?" "Do you encrypt your passwords at rest?" "Are your S3 buckets encrypted?" instead of wasting developer time answering questionaires nobody reads.