> security and compliance (which are not the same thing)

So much this.

I'd hesitate to even call them adjacent.

Compliance is nothing more than a set of checkboxes. It won't stop your developers from writing `sql.query("select * from users where username = '" + username + "'`.