Don’t Chase the Tools. Build the Instinct.

Security isn’t bought. It’s built, and owned.

On the first day of a project, you get access. On the last day, it goes away. Everything in between is where security lives.

We asked Paola Brizuela, who leads cybersecurity at Abstra, what that looks like day to day. Her first answer had nothing to do with software:

“Security takes more than buying tools. It requires visibility, clear owners, verifiable controls, and business continuity.”

Why instinct?

Security tools are like a smoke detector. They’re great at beeping when there’s smoke, but they won’t tell you that you left the front door open.

That’s the part only people catch. It’s the same instinct that makes you check the stove before leaving home, or double-check that you didn’t just hit “reply all.” A scanner can’t remember that a former teammate still has the keys to the repo, but you can.

On top of that, the house keeps getting new doors. A new integration here, a new account there, a shiny AI agent on Monday morning. No checklist grows that fast, but a good habit does.

And the best part? Nobody is born with this instinct. It’s like learning to drive: at first you check every mirror on purpose, and one day you just do it without thinking. So let’s practice.

Spot the open door

Which of these leave a door open?

A. A contractor wrapped up a project three months ago. Their repository access is still active.
B. An admin account opens with just a password.
C. A new SaaS tool gets connected to production on a Friday afternoon, with no review.
D. Only one person on the team knows how deployment works.

Answer: all four. Paola calls these the basics, and they’re where many breaches start. The good news is that every one has a simple fix.

That fix starts the day you join a project and lasts until the day you leave.

The life of an access

Day one: only the access the work needs.
On the project: development, staging and production stay apart.
Role change: permissions get reviewed.
Last day: access ends with the project, on time.

Simple habits, but they make a real difference.

BY THE NUMBERS
62% of breaches involved the human element.
Source: Verizon 2026 Data Breach Investigations Report

That number works both ways. If people are part of the risk, people are also the best defense. Which brings us to you.

Your 30-second check

On the project you’re working on right now, can you answer these?

1. What are the critical assets?
2. Who has access to them?
3. Which vendors handle the data?
4. What would happen if an essential system stopped working?

If you answered all four, that’s the instinct this edition is about.

LAST LINE
What’s one access you’d clean up today if you checked?

Read Paola’s full article: https://abstra.co/blog/secure-by-design-software-projects/