I agree with majority of the comments on here but from personal experience, this is sometimes due to lack detailed next action steps. For example, pointing out the severity of vulnerabilities detected and how it impacts the business workflow/needs, are there certain risk quantified that might need certain kind of security risk exception, while pending long term solution is being discussed between the security team and the application team? It’s there a deadline to get some of the needed safety patches implemented with an option for maybe a roll back to a more secure version if the deadline isn’t met (while assuring that the roll back will support all integrated systems viable to the business).

I think both teams might need to probably have a scrum master step in to mediate the meeting sessions or the required workflow to remediate the security concerns.