Yes. Although throwing red teams at the problem probably isn't the most efficient use of resources.

Better would be constructing a system where government-paid appsec teams are granted access to cloud source control repos for all projects + ability to randomly pentest whatever they desire.

If a breach is found (in release candidate stage or prod), the offender's contract is reduced by the prize amount, and that amount goes into the appsec team's budget.

The only way to make people care about appsec is to (1) increase the likelihood and frequency of exploits & (2) ensure exploits have direct budgetary impact on the teams developing the software.

Good idea. Also, anyone, including employees, can give them tips on how to get in, and can't be legally punished for it. Of course, simply handing over private-keys and passwords wouldn't be allowed, but giving them a tip to poke around an API exposed to the public would be okay.

It's "Top Secret".

What's not so secret is that CSEC pays low and kills your career growth.

I like that idea, or at least contract a private company to do the pentest. That makes it government-sanctioned and pushes the responsibility back onto the people who run the services in question, so we never have to guess about whether it's negligence or ignorance.

Are there any wider implications whete security doesn't get taken like we expect it to as a result?

That's a pretty good idea actually. I'd get behind that.

Yah, for sure. Or maybe unify the provinces with the feds in terms of infrastructure, govcloud primitives with a cross functional cross provincial mandate?