The question should be: why aren’t project managers and product owners making security implementation and review part of the sprints as a priority item?