Security is a process, not a product.

I have to remind the folks who want a dev to build a product and think they don't need to ever touch the product after release.