I&#x27;ve seen this happen way too often at various organizations. My take away is security is a function of the product, not some external process you bolt on top of it.<p>Organizations typically fail at security because they try to manage it as far away from the product as possible. That leads security and dev&#x2F;ops teams to manage their goals in isolations: one cares about preventing incident, the other cares about shipping products.<p>If Agile &amp; DevOps have taught us anything, it&#x27;s that everyone in the organization should be focused on serving the customer, be it through features, reliable operations, or data security. The only good way to do infosec is to embed security with devs and ops and make everyone shares the goal of making the product better.