“They're missing the process in between, and the people aren't sure what they're supposed to be doing because that process isn't there.”

Transcript evidence from Josh Grossman -- Building a High-Value AppSec Scanning Program.