Context
Teams often bolt security on at release. I integrated a tiny threat-model ritual into each sprint.
Threats
- Features shipped without considering attack surface
- New dependencies without security review
- Secrets/config drift across environments
Approach
- Security Acceptance Criteria on risky user stories
- 10-min STRIDE huddle at sprint kickoff
- CI/CD: secret scanning, dep audit, SAST on PRs
- Incident playbooks + rollback paths
Outcome
Security bugs found earlier; less rework and fewer emergency patches.
Lessons Learned
Security works in Agile when it’s a small, repeatable team habit.