Security practices traditionally have followed a waterfall model, adding security testing on at the end. Organizations need to coach their security programs and testers to prioritize analysis and risk, much like we do with agile stories, to better incorporate security defects with other feature work along the way.

Testing earlier assures better quality. But maybe most important, things like agile and DevOps—which encourage that you shift your testing left and allow for more collaboration between different parts of your team—have broken down the walls that previously separated testers for the rest of the organization.

Failure is measured by expectations. If we aim to be perfect, or set the expectation that only perfection is acceptable, we risk losing opportunities to get valuable feedback. Creating an expectation of perfection can lead to stagnation, not success. Instead, view failure as a learning experience.