Ask what could go wrong
Before adding a feature, a team sketches how people and information move through it. For an online shop, they might ask: Could someone pretend to be another customer? Could they see or change someone else’s order?
The answers help the team choose safeguards and tests, starting with the biggest risks.
Revisit it as the product changes
People who build, support and secure a product can spot different risks. The team reviews its decisions when the product changes or new threats appear.