When I'm doing security consulting to development teams one of the things we stress is that it's important to start taking the first steps towards improving your security posture. Moving your development team so that it's performing at the highest levels of maturity can take a lot of work (although I still recommend it), but the first step is ... well ... to take the first step.