Most security problems get built in early, then discovered late.
Automation and AI systems get rushed into production with access controls as an afterthought — a shared login here, an over-permissioned integration there. None of it looks like a problem until it is one. The fix is architecture, not a scramble after something goes wrong.