I sometimes view security firms as I view Wordpress security plugins. Back when I did Wordpress consulting I went through most security plugins and realized the

I sometimes view security firms as I view Wordpress security plugins. Back when I did Wordpress consulting I went through most security plugins and realized they were pretty much scams. Obfuscate some names and hashes and show some checks. They would run as part of your app, so your servers would need to be beefier. But you’d soon realize putting your server behind a waf, and hardening your server and db and generally following best practices got you 100% there. But novice developers felt very safe with these plugins and every website I fixed that had them was a mess. They didn’t understand what the plugins were doing, only that they showed green checkmarks. Security firms like to show green checkmarks.