Ask when security enters most software projects and you'll hear about the penetration test booked before launch. That test matters, but it examines decisions made months earlier: where data lives, what talks to what, who is trusted by default. A pen test can find an unlocked window. It cannot move the walls.
The systems that hold up under scrutiny are the ones where the walls were placed deliberately. Which components are allowed to see personal data? What is the blast radius if this one credential leaks? Can we answer a regulator's question from logs, or from folklore? These are architecture questions, and architecture happens at the start.
What 'secure by design' means in practice
It's less mystical than the phrase suggests. It means the data model separates sensitive data so access can be governed and audited. It means services get the least privilege that lets them work, so a compromise stays contained. It means the audit trail is a first-class feature, designed with the schema, not a log file someone hopes is still rotating.
None of this makes a project dramatically slower or more expensive when it's done at the beginning. All of it is painful, slow and expensive to retrofit. That asymmetry is the entire argument.
The question to ask your next supplier
If you're commissioning a system that will hold sensitive data, ask one question early: 'Show me where security shows up in your first month of work.' If the answer lives entirely in the last month of hardening, scanning and pre-launch testing, the architecture has already been decided without it.