I see a lot of people say this. Maybe I've just been lucky but all of my security audits have been sensible and easy. The only exception was at one company, an

I see a lot of people say this. Maybe I've just been lucky but all of my security audits have been sensible and easy. The only exception was at one company, an auditor flagged that weren't in compliance with "antivirus software is installed on all storage servers," and as they defined it, that would have included our Docker image repositories and S3 buckets. They gave us some suggestions on how we could do this, for example a Lambda-based solution that would scan all files uploaded to S3. We just said "no" and they dropped it.