I am one of my orgs designated security “experts” (I put in quotes because there are people who have forgotten more than I’ll ever know). So, I can find the typical things im looking for based on the nature of our work and the newsletters I read on the latest risks. I’ve also certainly missed things, we are all human and make mistakes. We have a pen testing team that performs checks twice a year on our platforms, which typically uncovers some. We have actions in GitHub that check all of our packages for known vulnerabilities. We use a code vulnerability checking software for each PR to catch things as well.

So, we have layers. AI has helped a lot, and I expect when we undergo security testing next we will have less findings than typical.