The development of business software has changed radically. For a long time, cybersecurity was perceived as a secondary element, a shield added to the application at the very end. In the business context, it was common to request development and, just before the launch, raise security as a minor process: a basic SSL certificate, a simple plugin, and relying on luck.

However, in 2026, this approach is ineffective and obsolete by technical and legal mandate. Cybersecurity is no longer an “extra”, but a structural design requirement. European regulations, such as the Cyber Resilience Act (CRA), demand clear responsibilities on how commercial software is built: it must be conceived secure from the start. For any SME that needs custom software, demanding development based on the “secure by design” principle is key to avoiding incidents, fines, and extra costs.

What “secure by design” means in plain English

To understand the concept of “secure by design”, it is useful to use an analogy with architecture and traditional home building. Imagine you decide to build an office for your business and you have two ways to approach the physical security of that building.

The first option is to build the structure paying attention only to room layout, aesthetics, and costs. Once the work is finished, you discover that the windows are easy-to-break single-pane glass, the doors are weak, and the design leaves blind spots out of sight. To fix it, you hire 24-hour security guards, install expensive surveillance cameras, and put bars on all the windows. You have spent a fortune trying to protect a structure that is inherently vulnerable. If an alarm fails or the guard gets distracted, the building remains exposed.

The second option, representing the secure by design approach, is to sit down with the architect before laying the first brick. Together you plan reinforced concrete exterior walls, windows with integrated safety glass, high-security locks straight from the factory, and an open layout that leaves no dark corners. You don’t need to spend fortunes on additional reactive measures because the physical structure of the building is already designed to naturally resist intrusions.

In the digital world, software behaves exactly the same way. Designing secure from day one means that engineers plan and apply cybersecurity best practices in each phase of development: from the database structure to validating user-entered information and encrypted communication between servers. Security is not added at the end; it is programmed into the codebase.

Real risks an SME faces with poorly designed software

Working with software that has not been designed secure from the start exposes your business to very specific problems that should be analyzed calmly and without unnecessary alarmism:

  • Late-stage fix cost multiplier: In software engineering, there is a golden rule: the later an error is detected and corrected, the more expensive it is to fix. A security flaw detected during the design phase is resolved by modifying a diagram or a few lines of code. That same flaw discovered when the application is already in production, being used by thousands of clients, can force you to stop the service and require hundreds of hours of emergency programming to rebuild the architecture. The cost scales exponentially.
  • Loss of customer trust: For any SME, the trust of its users is its most valuable asset. If your business suffers a leak of sensitive data — such as passwords or billing details — because the system did not properly encrypt information, the reputational damage can be irreparable. Restoring the trust of a customer who has seen their data exposed costs much more than having invested in clean development from the start.
  • Business operational stoppage: If your application has a serious structural vulnerability, a technical incident can force you to suspend service for days. In an online store, every hour of downtime directly translates into lost sales. In an internal digitalization system, downtime can freeze order deliveries, billing, or logistics, generating cascading losses.
  • Regulatory and legal compliance: With increasingly strict European data protection regulations (GDPR) and software security laws, regulators require companies to demonstrate that they have taken reasonable preventive measures. If a security incident is proven to have occurred due to negligence in software design, the SME can face complex legal issues.

Questions you must ask your development provider before signing

If you are thinking of contracting the creation of custom software, a management intranet, or a transactional website, it is essential to evaluate providers based on their technical maturity in cybersecurity. Here is a list of practical questions to ask before signing any contract:

  1. How do you integrate security into the initial technical design phases?
    • What to look for: The provider should explain that they perform a risk assessment of the application before coding. They should explain how databases are structured to separate sensitive data and how they plan access control logic and roles (who can see what within the application).
  2. What standards and technologies do you use for user and password management?
    • What to look for: Be wary if they program their own encryption or login system from scratch. Today, professional cybersecurity uses standardized protocols (such as OAuth, JWT tokens, or integrations with trusted identity providers like Supabase or Firebase). Reusing consolidated and audited standards is the correct practice.
  3. How do you ensure data validation on the server and not just on the screen?
    • What to look for: Many low-cost developments validate fields only in the user’s browser so that it looks pretty. However, an attacker can bypass that screen and send malicious data directly to the server. The provider must confirm that all information is validated and sanitized on the backend.
  4. How do you prevent vulnerabilities in third-party libraries used in the project?
    • What to look for: Modern applications are built using existing external libraries. If one of those pieces has a security flaw, your application will too. The provider should have automated tools in their workflow that continuously scan the code for outdated or vulnerable dependencies.
  5. What security maintenance and updates plan do you offer after delivery?
    • What to look for: No software is 100% secure indefinitely. New attack techniques and operating system flaws emerge constantly. The provider must offer a preventive maintenance service focused on applying security patches regularly and monitoring that the system continues to run robustly.

How we apply it at Giralabs

At Giralabs, we understand that cybersecurity is not a cosmetic add-on, but a founding pillar of our engineering quality. When an SME trusts us for custom software development or to undertake business digitalization, we apply the security-by-design philosophy in every development decision.

Our methodology includes:

  • Least privilege architectures: We design software in such a way that each module or user only has access to the resources strictly necessary to perform their function.
  • Secure infrastructure: We deploy our applications using leading cloud providers, configuring private virtual networks, specific application firewalls, and active monitoring.
  • Automated code audits and testing: We integrate static code analysis tools into our CI/CD systems. Every time we update an application, automated tests are run to ensure no vulnerabilities or insecure dependencies are introduced.
  • Supervised agentic approach: While using advanced assistance and agentic tools to speed up development, our senior engineering team acts as a strict filter. We audit each block of suggested or generated code before production deployment.

Conclusion: Investing in secure design is long-term savings

In today’s technology landscape, promising absolute or “100% guaranteed” security is an irresponsible statement far removed from technical reality. Perfect cybersecurity does not exist, as digital environments are constantly changing. However, it is possible to drastically minimize the probability of suffering incidents and ensure that, in the event of a failure, the system can recover quickly without critical data loss.

Adopting the security-by-design approach is not a technical burden; it is a smart financial investment. Avoiding extra costs from having to rebuild defective code, protecting your corporate reputation, and sleeping with the peace of mind that your business is protected by structural cybersecurity is what differentiates a generic software project from a premium engineering solution.

If you are planning a new digital project for your company, need to automate operational processes, or want to develop a mobile application that requires the maximum trust of your users, at Giralabs we are ready to assist you. Our commitment is to design and develop robust, scalable, and secure digital products from day one.

Contact our team today and let’s talk about how to build the robust software your company needs to grow with complete peace of mind.