
When organisations create a op security dept, they should spend the same amount money on beefing up operational groups to address what they find.
Otherwise the backlog gets tagged onto other priorities and isn’t a priority
But ‘gee look what we are doing’ big noting themselves and making sctual workers look bad
Do I sound bitter?