How well is your AppSec program working? How well is your DevSecOps program working? Are these two functions separate in your organization, or do they operate as one unit? What skills differences are there between the two functions/roles if any? Are they part of your IT ops team? Part of your security team? Part of your engineering team? All of the above? None of the above?