How do you balance security requirements with development velocity?