From security as opt-in to security by default