In reply to Robert Chase Sommer.

Yes! That’s exactly right. How you approach security needs to be grounded in your goals and what your users need to do. Just like with devops and CICD - velocity and rate of deploy vs checks and balances!