Most security tools respond after risk enters the workflow. Learn why upstream security changes the timing of control.