[flagged]

Setting aside the merits of DEI, this anecdote isn't indicative of it. I recall a client getting HP to do a security audit of a site I was working on, and it absolutely read like a committee put together a checklist of every possible thing they could think of. They flagged that user sessions weren't pinned to IP addresses, despite this being right around the time that cell phones became popular and their suggested remediation would have caused users who were riding on a bus between cell towers to get logged out while they were using the site.

There were plenty of even less useful flags, but that one stood out to me for some reason.

"Checklist security" has been a thing for ages.

That’s a pretty insane leap to go from “we have a non-technical security team” to “DEI caused this.”

Sometimes it is cheaper.

Most businesses run on a, "least to be in compliance" model.