The premise is fundamentally wrong. Product Security, Privacy, Data Protection, Authentication, etc... Are all product features. How is security not innovation, and how is a feature innovation; Innovation comes in many flavours. Its all about narrative. The most successful apps/products i have been involved with all viewed all of this as core unfair differentiators that customers value. This combined with teams that have a deep care to build robust understanding about what their users and customers care about and need, is what you really need. Everything else, yes Security & Privacy should be first class citizens of what your building and should be looked at as a core differentiator and pillars of innovation.

Balancing new app features with security concerns requires a security-first, user-centric approach. Security should enhance, not hinder, user experience

security should be a fundamental building block of any app. when it comes to managing resources to address app features, and/or security concerns - it is important to prioritise the security concerns of a higher order (critical, high). for the remaining security and app features, adopt a prioritization framework based on needs, urgency, complexity & value. fit all the critical and high issues, then the app features by priority. if all the critical and high issues is resolved, then work on the issues based on priority.

The straightforward answer is that security concerns come first. They cannot be mixed with app features. When an app prioritizes security, it means we already have a functional version without those new features. Regardless of the situation, security will always be our top priority.

Continual testing and monitoring the enterprise for security issues should determine what risk can be calculated. I don’t believe that a new feature should be developed for release without an impact assessment. Building layers of defence to thwart security breaches is vital. Easy monitoring is vital. Keeping clear communication through the necessary layers of hierarchy is key to ensuring a stable connection with all relevant stakeholders. Frameworks do add value, but shouldn’t be the sole driver for managing change, nor should this be a tick box approach either. Good governance and audit will build resilience into the organisation. Review, review and review, it’s crucial not to take for granted week 1 tested fine perhaps week 2 will not.