Security testing should be carried out at all stages of the software development lifecycle (SDLC), from requirements gathering to deployment and maintenance.