"Cybersecurity is broken because of the lack of consequences." If I may after few decades in - add in or change for competence. Most often my team and I test

"Cybersecurity is broken because of the lack of consequences." If I may after few decades in - add in or change for competence. Most often my team and I test apps that have been verified by multiple parties and we still find juicy stuff. Not always, but most often. Here's the kicker - most important ones aren't about the tech, but the business part of it (validations, processes, flow and so on). If I could make a very generic recommendation for most - check the logic and business first then make sure the tech is decent. In business - make sure you include people and management.