You nailed it. In my experience these "security" teams accumulate people who want PM level powers without having to deal with any of the accountability. The fa

You nailed it. In my experience these "security" teams accumulate people who want PM level powers without having to deal with any of the accountability. The fact is that security is a holistic concept and can ONLY be evaluated in context. That in turn requires good technical and operational knowledge. But people like that are rare and expensive, so instead we have entire armies of box-tickers who lack the intellectual capacity to even understand what a "tradeoff" means. Something went terribly wrong around the mid-90s, when security changed from a discipline practised and understood by hands-on professionals into a consulting gig. Disclosure: I've been doing infosec professionally since 1993.