Yeah, that is actually a really common problem, and it genuinely is the fault of the security team. One good way to communicate and discuss security requiremen

Yeah, that is actually a really common problem, and it genuinely is the fault of the security team. One good way to communicate and discuss security requirements is using threat models. A nice data flow diagram or architecture diagram showing the threat actor and attack vector helps a lot, along with any controls that exist. Unfortunately, security often doesn't seem to feel the need to explain themselves or discuss anything if they have a magic edict to wave about. I think that's a mistake, we should try to bring people along with us. And even find out we were wrong occasionally!