The Most Expensive Security Review Is the One You Skip
Most teams think security reviews slow down development. In reality, the opposite is often true. The most expensive security review isn't the one performed before production. It's the one performed after an incident.
Most teams think security reviews slow down development.
In reality, the opposite is often true.
The most expensive security review isn't the one performed before production. It's the one performed after an incident.
As AI agents and MCP deployments become more common, security teams are being asked to review something very different from traditional applications.
They're no longer reviewing only APIs.
They're reviewing:
- tools
- permissions
- approval workflows
- credentials
- side effects
- audit trails
And that's where many teams get surprised.
The Problem Isn't Authentication
Most organizations spend a lot of time discussing authentication.
Can the agent access the tool?
Can the user authenticate?
Is the API protected?
Those questions matter.
But they often miss the bigger risk:
What happens when the tool is used?
A tool that reads an order and a tool that refunds an order may both require authentication.
Only one can lose money.
Only one creates business consequences.
That's why production MCP deployments need side-effect analysis, not just access control.
The Cost Curve Is Brutal
A permission issue discovered during design might take ten minutes to fix.
The same issue discovered after launch can trigger:
- incident reviews
- engineering work
- emergency releases
- customer communication
- compliance reporting
The technical fix is usually the easy part.
The organizational cost is where things get expensive.
What Security Teams Actually Care About
When security teams review MCP deployments, they usually ask questions like:
- What tools exist?
- What can those tools do?
- Which actions change state?
- Which actions affect customers?
- Which actions affect money?
- Which actions require approval?
Engineering teams often see functionality.
Security teams see consequences.
Good reviews help both groups speak the same language.
Governance Is Not Bureaucracy
Governance gets a bad reputation because it sounds like paperwork.
In practice, governance is simply deciding:
- which tools should exist
- who can use them
- which actions need approval
- how activity is monitored
- how incidents are investigated
When these decisions are made before launch, deployments move faster.
When they're made after launch, every release becomes a negotiation.
What This Means For Production MCP
If you're deploying MCP in production:
- Classify every tool by risk level.
- Separate read-only tools from destructive actions.
- Require approvals for financial and administrative operations.
- Enable audit logging from day one.
- Store credentials in a secure vault, not in code or prompts.
The organizations that move fastest aren't the ones skipping reviews.
They're the ones doing reviews early.
Because fixing security problems before production is dramatically cheaper than fixing them after customers are affected.
Full article:
https://www.mcpforge.tech/blog/the-cheapest-security-review-is-the-one-you-do-before-production
Originally published by Dev.to Security. Aggregated on AIWithGhost for educational purposes β full credit and traffic to the original publisher.