This. I've established security programs at 3 companies over 10+ years. I've rarely encountered an engineer who didn't care. I've encountered many with competin

This. I've established security programs at 3 companies over 10+ years. I've rarely encountered an engineer who didn't care. I've encountered many with competing priorities. What gets measured gets done. Establish the right measurement to equip engineers to prioritize security and they'll get it done.