It's still common for security to be treated as a final review before launch — a checklist run through in the last sprint. By that point, the architecture is fixed, and most of what a security review finds can't be fixed without significant rework.
Security decisions made early are cheap. Choosing how authentication and authorization work, how sensitive data is encrypted at rest and in transit, and how services communicate internally — these are architectural decisions, not configuration toggles you can add later.
The same is true for compliance. Standards like GDPR, PCI-DSS, and SOC 2 impose requirements on data handling, logging, and access control that are far easier to satisfy when designed in from the start than retrofitted after the fact.
Threat modeling early in a project — asking "what could go wrong and who would want to make it go wrong" — surfaces risks while they're still cheap to address. It also gives the engineering team a shared understanding of what they're protecting and why.
Security built in from day one doesn't mean slower delivery. It means fewer expensive surprises later, and a system your business — and your customers — can actually trust.