An internal development team has migrated away from Waterfall development to use Agile development. Overall, this has been viewed as a successful initiative by the stakeholders as it has improved…

Agile and Waterfall do not have the same security posture by default - they require different security integration strategies, and equating them ignores the fundamental structural differences in how and when security controls are applied.

Agile is not fundamentally less secure than Waterfall - the lack of a formal upfront security phase is compensated by continuous security integration throughout sprints, making this statement technically inaccurate.

Being a more modern methodology does not inherently make Agile more secure - security quality depends on how well security practices are embedded into the process, not on the age or popularity of the methodology.

Agile development integrates security activities differently than Waterfall - rather than a dedicated security phase at the start or end, security reviews, threat modeling, and testing are embedded within each sprint or iteration. This approach, often called DevSecOps or Secure SDLC for Agile, can be equally rigorous when properly implemented. The key distinction is timing and distribution of security activities, not the absence of them.