Spot on, security is not something that can just be slapped together due to external concerns after the product is done - it needs to be part of the product and the mindset from day zero