On beyond “Detect and Respond” and “Secure by Design”