Global Security Forum

The reason we are discussing this here is, too many projects have retrofitted security as a patch to their existing projects. We all know that this fails.

The good practice is to develop security into your project from the very beginning.

I would say that a software company treating security as an afterthought is one you should pass on if you can. 

I completely agree. In my experience, security is much more effective when it's embedded throughout the SDLC instead of being treated as a final checkpoint. Finding vulnerabilities during design, coding, or CI/CD is significantly less expensive than fixing them after deployment or, worse, after a production incident.

Practices like secure coding standards, SAST, SCA, secret scanning, infrastructure-as-code scanning, and automated dependency checks help identify issues early. Penetration testing is still essential, but it should validate the effectiveness of the security controls, not be the primary method of discovering vulnerabilities. That's the core idea behind DevSecOps, making security a continuous responsibility rather than a last-minute activity.

Oh boy! Security and Privacy by Design (SPbD) has been a core part of IBM software design for many years now - and for good reason! No changes can go in, no new functions added, before first going through security review, and revisiting this review throughout the lifecycle... Much like a functional spec, this requires a documentation before starting development that outlines what changes to the  threat surface are expected, and how they will be secured,etc. Full details: https://www.ibm.com/trust/security-and-privacy-design

Security and Privacy by Design (SPbD) is a core part of IBM software design.

also ref: https://www.redbooks.ibm.com/redpapers/pdfs/redp4641.pdf

From day one!  That will make everyone's life easier.  Trying to retro fit security features after development is done is more complex and difficult.