Conducting regular security testing is time-consuming and challenging but crucial; implementing heavy DAST and penetration testing slows down pipelines.