“Usually after three to six months, they'd be like, okay, now we're gonna stop doing it.”

Transcript evidence from Farshad Abasi -- Three Models for Deploying AppSec Resources.