Regular vulnerability assessments/pen testing

Automated security testing within CI/CD pipelines

Code reviews and security audits

Third-party security assessments

Ad hoc internal assessments

No formal process in place