Security practices traditionally have followed a waterfall model, adding security testing on at the end. Organizations need to coach their security programs and testers to prioritize analysis and risk, much like we do with agile stories, to better incorporate security defects with other feature work along the way.

Testing earlier assures better quality. But maybe most important, things like agile and DevOps—which encourage that you shift your testing left and allow for more collaboration between different parts of your team—have broken down the walls that previously separated testers for the rest of the organization.

In times of major change, particularly organizational change, it's normal for people involved to experience turbulence, including anxiety, anger, or uncertainty. If you’re overseeing a change, how you communicate with those affected can significantly decrease—or increase—the duration and intensity of that turbulence.