How does the cost of fixing a security bug change depending on when it's discovered in the software development lifecycle?

The later you find it, the more it costs — roughly exponential, from x1 in requirements to hundreds of times more in operations.

The cost climbs because a late-discovered flaw has already been built into design decisions, code, tests, documentation and live data — all of which must be unwound and re-verified:

Key takeaway: Fix security issues early - it's much cheaper to address them during requirements than in production.