> True security comes from general IT practices followed by engineers themselves.

I have yet to meet an org whose engineers care about security, or who would not compromise security if secure practices got in the way of shipping a product or feature.