Security built into the requirements, not bolted on afterwards

Security usually arrives too late to shape anything. I work at the other end — putting a security lens on the requirements while they are still being written, on the everyday processes that have to carry the controls, and on who can reach what once the system is live. The same analysis discipline, applied so that what gets built is defensible before anyone reviews it.