i have spent a lot of time planning security team roadmaps and it blows my mind how little quality information is out there talking about this. OWASP SAMM is pretty amazing, but oh man it is so much to read through