infosec is basically QA with veto powers. It's mostly just checklists and passing the book. A cost center everyone wants to cut..until it's too late.