Security is a process, not a product. Security is about behavior, not process. You have to start with behavior, and its best to start simple and build from there. Most organizations have 1.6 people dedicated to security for every 100 developers (anecdotally this holds up when I look at my own experience). The only way the security team can make an impact is not by imposing processes, but by changing the security culture to create a security mindset”]
Source: https://www.csoonline.com/article/3172784/is-devops-security-about-behavior-or-process.html