Security review at the end of delivery is both a bottleneck and easy to route around. Those two properties are related: anything slow enough to be a bottleneck creates pressure to find another way, and there is always another way.
On one engagement, vulnerabilities reaching production fell by roughly half. The interesting part is how little of that came from adding controls.
Late review finds real problems at the worst moment
By the time a change reaches a security gate, the architecture is settled, the deadline is close, and the finding is expensive. Everyone in the room knows it, which is why late findings so often become accepted risks rather than fixes.
The gate is not wrong about the problem. It is wrong about when it can be acted on.
Move the check to where the decision is made
Scanning moved into the developer's own loop: dependency and secret scanning at commit, static analysis in the pull request, image scanning at build, and only the checks that genuinely require a running system left further down.
The important property is not shifting left as a slogan. It is that a finding arrives while the person who caused it still has the context to fix it in minutes, rather than weeks later when it belongs to whoever is on call.
Two things made this survivable. Findings were actionable, naming the file and the fix rather than a category. And the noise floor was managed aggressively, because a check that reports twenty findings of which two matter trains people to ignore all twenty.
The provisioning time was a security control
This is the part that surprises people. Infrastructure provisioning took days, and that delay was directly responsible for a class of insecure configuration.
When the governed route takes three days and the ungoverned one takes an hour, you have chosen the ungoverned one on everyone behalf.
Teams under deadline pressure did not skip the process out of carelessness. They used what they could get, which meant hand-built resources, over-broad permissions granted to unblock something, and configuration nobody reviewed.
Reducing provisioning from days to minutes through least-privilege self-service removed the incentive. The fast path and the governed path became the same path, and the ungoverned route stopped being attractive because it was no longer faster.
Secure defaults beat secure reviews
Security requirements were pushed into the infrastructure code and the compositions themselves. Encryption on by default, logging attached at creation, network placement decided by the composition rather than by the requester, permissions scoped to the service.
A developer asking for a database got an encrypted, logged, correctly placed database without knowing any of those requirements existed. Compliance held by construction, and there was nothing to remember.
What we would not repeat
We turned on more scanners than we could triage early on, and spent weeks in noise. Starting with a narrow set tuned to near-zero false positives, then widening once people trusted the output, would have got to the same place faster.
Signal is the scarce resource here. A security programme that produces more findings than the organisation can act on has converted a security problem into a backlog problem, which is a worse thing to have because it looks like progress.
