Risks inherent with third-party or legacy components with inherited breach possibilities.
Lack of required agility level to respond quickly to changes.
Hiring, training, and maintaining security experts.
Relying too much on automated tools.
Poor AppSec plan development.