How do you balance development velocity with security compliance when engineering teams are pushing daily releases?