7.1 Introduction7.1.1 Make security tangible, not another compliance slideshow7.1.2 Ease, not pain, should be synonymous with security7.1.3 Resistance is necessary and good7.1.4 Security is achieved through continuous, small steps7.1.5 Security is enablement, not gatekeeping7.2 Pattern 1: make security tangible, not another compliance slideshow7.2.1 Adding to the cultural fabric7.2.2 Accelerating the spread of knowledge7.2.3 The difference between reading and knowing the incident response plan7.2.4 The discipline of security chaos engineering7.2.5 Summary7.3 Pattern 2: ease, not pain, should be synonymous with security7.3.1 Mindfully managing tension7.3.2 Dealing with a complex world7.3.3 Beware premature abstractions7.3.4 Security is dynamic, not static7.3.5 Take the product mindset7.4 Pattern 3: resistance is necessary and reasonable7.4.1 People react differently to change7.4.2 The nature of bureaucracy7.4.3 Use data to attack the problem7.4.4 Summary7.5 Pattern 4: security is achieved through continuous small steps7.5.1 The flow of work7.5.2 Delivery constraints are security constraints7.5.3 Aligning empowerment with incentives7.5.4 Summary7.6 Pattern 5: security is enablement, not gatekeeping7.6.1 One size does not fit all guardrails7.6.2 Building shared understanding with threat modelling7.6.3 Summary7.7 ConclusionReferences