Right now, it's reactive. I'm a big fan of Dr. Ann Cavoukian when she talks about privacy by design—and it should be “security by design”.
A new term has come out called Sec and DevSecOps and DevOps—that is, as you're writing your code, you should be considering security, absolutely.