Making secure development a default, not an afterthought