A security programme fails in two familiar ways. It starts from a picture of the team that is kinder than the truth, or it asks for a leap that delivery cannot afford. This talk begins with an honest look at where a team stands today: what is already checked, what is checked by hand, what is not checked at all. From there the way forward is small steps, each one folded into the pipeline the team already runs, so that compliance is something the process produces rather than something a quarter ends with.
I gave this talk at OpenText Solutions Day in Jakarta in October 2025, the second of my two sessions that day.