Security is a design decision, not a patch

The mental image of a security breach — hooded genius, green terminal, sixty seconds of furious typing — has done real damage. It lets businesses believe security is about stopping geniuses, when it's mostly about closing doors that were never locked.

The incidents that actually happen are mundane. An outdated dependency with a known vulnerability. Credentials in an email thread. An admin panel indexed by a search engine. A former employee's account that was never disabled.

This is good news, because mundane problems have systematic answers. Least-privilege access from day one. Dependencies tracked and updated. Secrets in a vault, never in code or inboxes. Access reviews on a calendar, not on a hunch. Backups that are tested, not assumed.

The phrase 'shift left' has become jargon, but the idea is sound: security decisions are cheapest at the whiteboard and most expensive after the breach. Architecture reviews, threat models and sensible defaults cost a fraction of incident response.

We design every system on the assumption that it will be probed. Not because we expect drama, but because locks are cheaper than locksmiths.