This is what happens when security is treated like a checklist item instead of a core requirement