Hacker News Reader

Sometimes the answer is "so our sales team can tell people our security is better than our competitors."

Hah, I worked for a software security company. This is literally the entire industry.

Check these boxes to be compliant to make that enterprise sale.

Is it actually more secure? Who cares, insurance will cover us now and the enterprise paid us.

I still have PTSD from dealing with HIPAA and SOX stuff. Don’t run your own credit card processing if at all possible.

Same thing with selling software to the government. "Is the software secure" is far less important to those customers than "does it pass the scan".