✏️ Explanatory Question
The workshop should be conducted during the implementation phase. At this stage:
Business requirements are defined
Security design is drafted
Changes are still affordable
Conducting it too late can lead to rework, user dissatisfaction, and security vulnerabilities.