In order for application developers to detect potential vulnerabilities earlier during the Software Development Life Cycle (SDLC), which of the following safeguards should be implemented FIRST as part

Source code review occurs after code has already been written, meaning it is reactive to design decisions already made and misses architectural vulnerabilities introduced before the coding phase.

Acceptance testing takes place near the end of the SDLC to verify that the system meets business requirements, making it one of the latest - not earliest - opportunities to detect security vulnerabilities.

Threat modeling is performed during the design/requirements phase of the SDLC - before coding begins - making it the earliest possible intervention point for identifying vulnerabilities. By systematically identifying attack surfaces, threat actors, and potential weaknesses in the architecture, developers can design security controls into the system from the start rather than retrofitting them later. This 'shift-left' approach reduces remediation costs and forms the foundation upon which all other testing activities (code review, automated testing, acceptance testing) are prioritized and scoped.

Automated testing (e.g., SAST/DAST) is applied during or after the coding phase and depends on existing code or running applications, so it cannot detect design-level vulnerabilities before development begins.