Custom software moves fast; procurement, banks, and regulators move slowly. Threat models are not academic exercises—they decide whether a first enterprise customer signs a data processing agreement or waits for a competitor to demonstrate control.
Data classification precedes framework fashion
PII, financial records, health-adjacent notes, and trade secrets each carry distinct retention, residency, encryption, and backup expectations. Skipping that partition leaves teams bolting vault products onto prototypes never engineered for regulated payloads.
Authentication and authorization remain distinct failure modes
OAuth gets people through the lobby; authorization decides what they can touch after. Policy-as-code (or an equivalent) lets product managers reason about roles without reading middleware line-by-line. Cherry Tech pairs that with explicit decision tables for tenant isolation, impersonation audit, and break-glass accounts—paper policy without executable enforcement does not pass serious review.
CI/CD is an attack surface the same way the app is
Pipelines that ship straight to production without peer review or artifact signing make the Git provider the weak link. Branch protections, OIDC into clouds, and secrets scanning on every commit belong beside application monitoring in the same incident culture.
Logging earns budget when retention matches law, not when vendors upsell
Authentication events, permission changes, exports, and privileged actions need tamper-aware storage windows aligned to legal hold across every jurisdiction sold into—including Middle Eastern entities that expect regulator-ready Arabic log exports.
Drills expose whether the risk register is fiction
Quarterly tableaus—key rotation, backup restore, simulated credential leaks—paired with lightweight pen tests after major releases turn PDFs into prioritized engineering work. Findings that never attach to owners might as well not exist.
Security culture compounds. Teams that wire these habits in from sprint zero sidestep the six-month “compliance scramble” that postpones launches exactly when enterprise revenue is within sight.