[solatic]

It's all about what the organization actually values.

It's relatively simple to prevent deploying the new version of a service that has unpatched vulnerabilities, forcing developers to patch the vulnerabilities before being able to put new feature-work in production. It's much more complicated to do so when you're pressured to use "all-in-one" continuous deployment platforms that don't really make allowances for security's role, and it's politically unfeasible when the business requires you to remove the control because the sales team made promises that turned into deadlines. Everybody wants the prize of pronouncing themselves both reliable and secure, but nobody wants to pay the price.