What I did. Defined SLIs and SLOs so reliability had a number attached rather than a feeling. Hardened networking and access, and enforced encryption in transit and at rest across the platform. Ran vulnerability scanning continuously rather than at release checkpoints.