[candiddevmike]

Even worse, sometimes the good tools don't check the box because they lack some pointless certification or the CISO "doesn't recognize the name".