[catlifeonmars]

This is why it’s so important for the organization and C-level to be fully bought in to security. What I’ve seen work in the past is for the devs/PMs to own security for the products they develop, and own the liability for security vulnerabilities. In this model, the security team acts more like an internal consultant that accepts invitations to review products/services.