Comment by arccy

I think once your eng org > 300 people and you have a dedicated infra and security team, it's going to be on their radar to do at some point.