Shift-Left Security
Moving security checks earlier so findings arrive while the author still has context, on the condition that the signal-to-noise ratio justifies it.
The economics are straightforward: a finding delivered in a pull request costs minutes, the same finding in a quarterly penetration test costs a scheduled fix, and in production it costs an incident. Static analysis, dependency scanning, secret detection, container scanning and infrastructure policy checks all belong early.
The condition is the part usually skipped. Early checks are in everyone's way, so their false-positive rate is not a nuisance but a determinant of whether the control survives. A scanner reporting two hundred issues on a first run, most of them irrelevant, teaches the team to ignore the output — and the ignoring generalises to the findings that mattered.
The practices that make it hold: fail the build only on severities that genuinely warrant blocking, and report the rest without blocking; baseline the existing backlog so new code is held to the standard while old findings are worked separately; tune aggressively and treat a false positive as a defect in the tooling; and give every finding a remediation the author can act on immediately. A precise scanner with narrow scope beats a comprehensive one that is muted.