“The reason I don't do that is the software security program has to be embedded into software development, and the developers have to own it.”

Transcript evidence from Jim Routh -- Selling #AppSec Up The Chain.