Governments worldwide, from the UK to Australia, have set ambitious goals to enhance software security by 2030, particularly within critical infrastructure. However, achieving a secure-by-design (SBD) approach is not merely a matter of deploying advanced security tools or implementing stringent policies. Rather, it necessitates a fundamental shift in organisational culture, prioritising security at every level of software development. The path to widespread SBD adoption is neither straightforward nor immediate. The size of an organisation, the maturity of its security culture, and industry-wide acceptance all influence the timeline for full integration. Most organisations will require three to five years to...