It's mandatory as part of the SDLC and support by appropriate tooling, unfixed higher level vulnerabilities are periodically tracked by middle-upper management