When security decisions come too late, and attackers know it