Comment by dgoldstein0

4 months ago

I agree it's bad, but you are assuming a lot of institutional memory which may not exist

Yes, I expect a security engineer to hold knowledge. That's why they have a job, instead of replacing the security them with an LLM. If nobody in the team has that experience, it speaks exactly to the issue that has been outlined in the OP: not enough knowledge of security issues beyond the basics.