Information security is a quality attribute that can't easily be retrofitted. Concerns such as authorization, authentication, access, and data protection need to be defined early so they can influence the solution's design.
However, many aspects of information security aren't static. External security threats are constantly evolving, and the maintainers of a system need to keep up-to-date to analyze them. This may force change on an otherwise stable system.
Functional changes to a legacy system also need to be analyzed from a security standpoint. The initial design may have taken the security requirements into consideration (a quality attribute workshop is a good way to capture these) but are they reconsidered when features are added or changed? What if a sub-component is replaced or services are moved to a remote location? Is the analysis reperformed?
It can be tempting to view information security as a macho battle between evil, overseas (people always think they come...