[cscharenberg]

This argument against checklists would apply anywhere for checklists: healthcare, airplane pre-flights, auto mechanics. Checklists enforce a minimum set of thought processes.

Suggesting checklists be discarded because some people don't do more than the minimum is a ridiculous misunderstanding of their value and human behavior.

This post argues for a detailed thought process of "Vulnerability Taxonomy" which could lead to new ideas, but also fails to enforce any minimum. Moreover, by encouraging exploration of various security areas (which is good) it still leaves you to your own knowledge which will be faulty and insufficient in some areas.

End result of this sounds like you'll have your own homegrown checklist, but it won't be called a checklist and it still won't adapt automatically and thinking will be required.