“I think developer education is overrated. And I think what we need to do is get to the frameworks and say to the frameworks, you need to fix these things based around the ASVS.”

Transcript evidence from Andrew Van Der Stock -- The New OWASP Top Ten.