It’s crazy how many defects you’ll find once you start poking around security products
Yeah I once pointed some supply chain software at itself and embarrassed the vendor badly.
90% of it is box ticking.
You are probably embarrassing the wrong people. Multiple layers of people before the engineers usually.
It hurt them all the way down. Believe me.
The best part of this memo is now you can use the memo's standards instead of the vendor's "stated" standards. And these standards are bleeding edge - very few products will actually pass muster.