A security engineer at a software development company has identified several vulnerabilities in a product late in the development cycle. This causes a huge delay for the release of the product…

SDLC is a broad, generic framework that encompasses many methodologies and does not inherently define iterative cycles, so security testing may still be deferred to late phases without a specific iterative structure.

The spiral model emphasizes risk analysis at the start of each phase, but its phases are longer and less frequent than Agile sprints, making it slower to surface and remediate security vulnerabilities throughout development.

Waterfall is a sequential, linear methodology where distinct phases such as design, implementation, and testing occur in order, meaning security testing is typically performed near the end of the cycle - the exact problem described.

Agile development breaks work into short, repeatable sprints where security testing can be embedded in each iteration, ensuring vulnerabilities are discovered and remediated continuously rather than all at once near release. This aligns with DevSecOps principles, which shift security left in the development lifecycle to reduce late-stage discovery costs and delays. The iterative feedback loop means the security posture improves incrementally with each sprint rather than being a final-stage gate.