Shifting left – integrating security early in the software development lifecycle – is a no-brainer. It cuts costs and provides a more integrated solution than retrofitting security. However, many developers view this added responsibility as a burden, increasing their workload, slowing them down, and distracting them from creating core business product functionality. As a result, it often gets rushed through or pushed to the back of the queue.

For CISOs, the shift-left process can mean losing control over critical security functions, leaving them at the mercy of developers to code everything. This can result in long delays, sometimes lasting months, for the implementation of adaptive MFA, audit logs, regulatory/security policy adjustments, and other measures necessary to prevent breaches.

Control over customer ID management may be seen as peripheral by both groups, yet both have a vested interest in ensuring that software is fit for purpose and does not enable breaches. Implementing a distributed ID management approach can lead to better outcomes for both teams. Each can advance their departmental goals: Infosec gains greater control without relying on developers, while developers experience a reduced workload, enabling them to focus on product development and minimize bottlenecks.