During the transition, security teams continue assurance activities while gradually taking part in requirements and design. They should build the participation role as agentic tooling and mature upstream practices free capacity, rather than abandoning assurance before that capacity exists.