Ten plus years ago the security team would actually read our code. They knew what to look for, where the language or database or server had vulnerabilities. Any issues they brought forward were actual real issues that needed attention. Now so many "security researchers" are simply running our code through automated tools. I have to spend time helping them create the Jenkins jobs to run the task and then they also need help analyzing the results. For example I had to explain dev dependencies don't ship with our production code so a given exploit is not applicable. Do I just work for a junk company or is this the new norm?
