“With application security, starting with something like a BSIM framework, where you're looking across the different domains and take, take the existing— because every company, regardless of whether they have a dedicated security program or not, or a very well-built-out one, like, they're going to have some of the practices.”

Transcript evidence from David Quisenberry -- Building Security, People, and Programs.