Running security design reviews at scale
How a small security team reviews hundreds of designs a year: intake and risk tiering, templates, threat-model artefacts, paved roads, security champions, findings tracked to closure and the metrics that show it works.
01Intake and risk tiering
- Design an intake that routes work by risk, not by who shouts
- Run a review with a template and a threat-model artefact
- Use paved roads so most designs need no review at all
- Scale with security champions without lowering the bar
- Track findings to closure and report metrics that matter
A team of five cannot review two hundred launches a quarter in depth. The trick is to spend deep review time only where risk is high and novelty is real, and to make everything else self-serve and safe by default.
| Tier | Triggers | Review | Target turnaround |
|---|---|---|---|
| 0: paved road | Uses standard templates, no new data class, no new external exposure | Self-attest checklist, automated checks | Same day |
| 1: light | New internal service or new third-party integration with low data class | Champion review with template | 3 days |
| 2: standard | Handles confidential data, new internet exposure, new authn or authz logic | Security engineer, threat model session | 1 to 2 weeks |
| 3: deep | Payments, crypto, tenant isolation, admin planes, new trust boundary | Senior engineer plus architecture board, pen test before launch | Planned with the project |
# intake questions that compute a tier
data_class: confidential # public | internal | confidential | restricted
internet_facing: true
new_authn_or_authz: false
handles_payments_or_keys: false
third_party_data_sharing: true
uses_paved_road: [service-template-v4, api-gateway, sso]
deviates_from_paved_road: ["custom file upload pipeline"]
launch_date: 2027-01-20
# -> tier 2: confidential + internet facing + deviation from paved roadStaff-level prompt: "you're the only security engineer for 300 developers, how do you handle design reviews?" Answer with tiering, paved roads, champions and a template, then say what you personally review and what you deliberately do not.
This is an advanced module
Advanced: Security Architecture at Scale is part of the Pro pass. 3 more sections — the deep dives, the final design, follow-ups and the test — unlock with it.
Already a cyart.io or studio.cyart.io member? Your pass code is in your Studio account.