[varunjain99]

The only way you can do secure by design/default is if the customer of your service experiences a productivity gain.

For example, if they can deploy infrastructure more efficiently (and securely as a byproduct). Or if they're able to get reliability out of a software library (and security as a byproduct).

You have to find these win-win situations where the developers/clients are not even aware of security improvements.