During which stage of the SDLC process should security be consulted and begin its initial involvement?

Involving security only at the testing stage means vulnerabilities may be deeply embedded and more expensive to fix.

While security is crucial in the design phase, it's not the initial involvement; requirements must first define what needs to be secured.

Involving security during development is too late for foundational security decisions and makes remediation more difficult.

Security should be involved in the requirement gathering phase to identify and define security requirements early, such as authentication, authorization, data privacy, and compliance. This "shift-left" approach ensures security is built into the application's foundation rather than being an afterthought, which is more cost-effective and reduces vulnerabilities.