What if compliance is giving us a false sense of security? Warfighters need cutting-edge capabilities now, including AI. But they need them securely. Most systems are designed first and secured later. Against sophisticated nation-state adversaries, that may be a losing strategy. Drawing on RAND's latest research, this session explores a fundamentally different approach: starting with mission risks, unacceptable losses, and system hazards, then engineering security directly into the architecture. Learn how STPA-Sec, the Security Design Order of Precedence (SecDOP), and security-first engineering challenge conventional practices and redefine what it means to build systems that are trustworthy by design rather than compliant by inspection.