This paper introduces delay-alignment modulation (DAM) for secure integrated sensing and communication (ISAC). Due to the broadcast nature of multi-user downlinks, communications are vulnerable to eavesdropping. DAM applies controlled per-path symbol delays at the transmitter to coherently align the multipath components at the intended user, enhancing the received signal power, while simultaneously creating delay misalignment at the eavesdropper (Eve). To mitigate sensing degradation caused by multipath propagation, we propose a two-stage protocol that first estimates the angle and then the delay of the line-of-sight (LoS) path after suppressing multipath interference. We derive the secrecy spectral efficiency (SSE) and the Cramer-Rao (CRB) of the target delay. Finally, we develop a path-based zero-forcing (ZF) precoding framework and formulate a max-min SSE design under CRB and power constraints. Simulation results show DAM significantly outperforms the strongest-path (SP) benchmark in terms of SSE, while meeting sensing requirements, since intentional delay alignment at legitimate users degrades reception at Eve.