“Security stifles innovation”

Reality: Innovation without security puts customers at risk.

Why do we believe product teams can innovate in every area except customer safety? Security is full of unsolved design problems:

Eliminating entire classes of coding error (see C-02)

Making safer defaults the easiest path for developers and customers

Designing systems that anticipate human error and recover safely

Security can slow a release, the way reliability and accessibility can. Nobody calls those a tax on innovation.

Discussion prompts

• What would "security innovation" look like for your product team?
• What security settings do your customers most often misconfigure — and how might you redesign the system to make the safe choice the default?
• Where in the development process is security a checkpoint rather than a design input? What would it take to change that?