Four years later, half of what I wrote is embarrassing. The other half is still true. Your WAF is still useless, your SIEM still spams your on-call, and your security team still cannot code. Let's fix all of that.