Earlier you start, the most effective you’re going to be for two main reasons. One is that people won’t even have a chance to form bad habits if security was always in place and the second is that it’s more expensive to change architecture design and refactor a finished product.