Right, and it's important to keep up that attention. Access control and permission management systems quickly lose focus, and that's exactly vhen vulnerabilities creep in. Most issues with security systems--infra and application security--happen after the first six months, when no one is looking.

Full system audit and reviews, anomolous access tracking, principle of least privilege, these almost are never built in to start, and then never get prioritized until the moment when everyone says: We needed that.