Security is a design principle, not a phase
You can't bolt on what should have been built in.
Having learned to break systems before building them, I assume an attacker at every trust boundary. Input validation, least privilege, and a strict content-security policy are design decisions, not a checklist run before launch.
Security added late is always partial and always more expensive. Designed in, it mostly disappears — it becomes the shape of the system rather than a layer on top of it.