In most organizations, security still focuses downstream on review and testing. Moving upstream into requirements and design may meet resistance. Security careers and team charters often center on finding bugs and gatekeeping, while leadership commonly measures security through vulnerability counts and audit outcomes. Recognizing these incentives helps teams plan the transition.
The shift is strategically necessary regardless. Security expertise applied at the requirements and design stages produces more leverage per hour than the same expertise applied to post-implementation review; the framework's premise is that this leverage is where security's remaining capacity should be invested. In an environment where AI-assisted development multiplies the volume of code produced, the option of scaling gatekeeping to keep up with generation does not exist. The security function either moves upstream or falls further behind.