It's proactive, but I've been working in various security-oriented IT roles for ~15 years now, and I'm trying to take my own advice [1], so I'd hope I can do it justice. :)
[1] https://chair6.net/startups-and-security-questionnaires.html