Security any given day takes precedence since data lost/theft put the whole business in jeopardy situation. Performance is like cherry on top, more the better and is more related to user experience. So always fixes the security stuff first and then performance issues

Data is a new Gold. That's what I always say whenever I deliver a session. Choosing between Security and Performance is simple. Security is and will always take precedence. One can work on performance once the DATA is secure.

Once you got breached, performance will be the least you are going to be concerned about. If you are vulnerable to attacks, set all your performance concern aside first. Secure your environment. Run your audits, then you go grab the next query to optimize afterwards.

Monitor current performance metrics and security postures. Identify acceptable performance thresholds and security vulnerabilities that need immediate attention. Develop solutions that enhance both security and performance, such as optimizing queries, using indexing judiciously, and employing secure coding practices that do not compromise efficiency. Continually assess both performance and security. As threats evolve and business needs change, be ready to adapt your strategy.