A cloud platform team discovers that new object storage containers are created publicly readable and unencrypted unless an engineer remembers to change the settings, and several have already been exposed. Which principle should guide the fix?

Secure by default means that the initial state of a system or resource is its most secure reasonable configuration, so protection does not depend on someone remembering an extra step. For cloud storage this means private access, blocked public sharing and encryption enabled from the moment a container is created, enforced through platform defaults, organization-wide policy guardrails or templates. Any exposure then requires an explicit, reviewed exception that leaves an audit trail. Adding a web application firewall in front of storage endpoints addresses a different problem; storage access is authorized by the platform's access policies, and a misconfigured public container is reachable directly regardless of an HTTP filter in some other path. Post-creation peer review is a detective control that leaves a window of exposure between creation and review, and it multiplies effort across every container ever created. Awareness training is worthwhile but still relies on human memory, which is the failure mode already observed. Exam caveat: secure by default is new to Domain 5 in the 2026 outline and pairs naturally with secure by design in Domain 1; design is about how the system is built, default is about how it ships and is first configured. Operational check: create a test container without specifying any settings and confirm it is private and encrypted, and confirm that a policy guardrail blocks or alerts on any attempt to make a container public.