>filled with people who check boxes That's why my switch from software development to application security only lasted four years. It drove me up the wall to f

>filled with people who check boxes That's why my switch from software development to application security only lasted four years. It drove me up the wall to find so many vulns and have them ignored because they weren't necessary to fix for the various compliance checklists to be completed. No one cared if systems were actually secured, they just cared that they got their compliance certified so if there ever were a breach, they'd have coverage for their liability. It's also an area where most people in it have little to no actual programming experience so when tools mark potential vulns, programmers can get away with claiming it's a false positive and everyone moves on, even if it's a plain as day case of clear text PII going out over the internet or some ancient injection vuln that no one wants to get their hands dirty fixing.