Product security
Making the secure path the easiest path
Research on defect origins has been consistent for three decades. Most defects are introduced early — roughly 70 to 80 percent in requirements, architecture, and code.1 Fixing in production runs 50 to 100 times more expensive than fixing in requirements.7
The gap between those two facts is widening. Meanwhile only 26 percent of CISA Known Exploited Vulnerabilities were fully remediated.8 Veracode's 2026 data puts average fix time at 252 days, up from 171 five years ago.9
Late involvement, big-bang reviews, manual processes, unclear ownership, tool sprawl.
We need a different model: continuous, integrated, environment-aware, and automation-first.
Defects mass on the left. Cost masses on the right. Friction is what carries a defect from one end to the other.
A requirements defect is not intrinsically expensive. It becomes expensive because design decisions, code, tests, and eventually deployed instances got built on top of it. Cost is a function of delay.
The queue is the control.Whatever your scanners find, your actual exposure is set by the interval between a defect being created and an engineer hearing about it. If you have never measured that interval, you do not know what your control is set to.
It moves the review earlier without removing the wait, producing an earlier bottleneck instead of a later one. What has to move left is feedback latency, not calendar position.
Security needs to run in the flow of engineering, not next to it.
Two mechanics do most of the work.
Ratchet, don't gate. Block only on new criticals in changed code. Nobody fixes the backlog to ship — they just cannot make it worse.
Exceptions expire. Named business risk owner, expiry date, compensating control. Exceptions security owns never close.
None is a new class of tool. Same tools, moved off the calendar and onto the commit.
A device fielded in 2026 is supported into the 2040s. Frozen toolchain, vendor BSP with no upstream, patches that may require regulatory action. Five mechanics.
Risk reduction, speed, friction — not activity. Scans run and reviews completed are attendance metrics.
The trade is real. You give up veto points, spend more engineering effort upfront, and accept residual risk in writing with a named owner. If every exception still routes back to security for a decision, you kept the gate and added paperwork.
Some things stay gates. Gate the irreversible and the legally attributable: a premarket submission, production access to patient data, the first agent with write authority into a system of record. No model sets a risk acceptance, closes a finding, or signs a regulated release.
Most programs have it backwards — they gate the routine, where volume guarantees a workaround, and automate the exceptional, where a human decision was worth the wait.
If you change one thing this quarter, measure your queues.
Provenance. Cost-to-fix multipliers are widely reproduced and poorly documented. The escalation trend is well supported; the specific stops trace to IBM Systems Sciences Institute data whose methodology was never fully published. Boehm's original range is 6x–100x. Defect-origin shares come from function-point data on general quality defects, not security defects specifically. Treat both as directional.