Experts suggest creating a culture of security champions, getting granular with security policy to allow different teams to move at appropriate speeds, and introducing changes gradually to ensure sustainability.