Seven habits that help security teams reduce risk without slowing delivery