Validating Findings by Security Engineers Pros: - Ensures accuracy and relevance of findings before they reach product teams - Reduces false positives, saving development teams time and effort - Might provides a layer of expertise in assessing the severity and impact of vulnerabilities Validating Findings by Security Engineers Cons: - Requires a sufficient number of skilled security engineers, which might be challenging for some organizations - May slow down the process if security engineers are overloaded with validation tasks - For Software Composition Analysis findings (known vulnerabilities) I, as a sec. eng., struggle to analysis if it is a false positive/true positive due to a lack of insights in the application Pushing Findings Directly to Product Teams Pros: - Accelerates the process by immediately notifying product teams of potential vulnerabilities - Empowers product teams to take swift action in addressing security issues Pushing Findings Directly to Product Teams Cons: - Increases the workload on product teams, potentially leading to frustration