Secure Design in an Agentic World

A key component of modern application security programs is the secure design review function. This is an architectural function responsible for reviewing product designs against an organization's product security standards and architectural best practices. For many organizations, this is also where threat modeling is incorporated into the SSDLC. It serves as an enforcement and measurement point for the controls and standards an organization applies to its products.

As organizations move toward more agentic ways of writing code, the product security industry will need to adapt and scale to keep pace with development teams' increasing rate of code production. We will see a focus on reducing manual secure design reviews to meet these increased scale requirements. Manual secure design reviews will be reserved for high-risk products and features.

One way to improve the efficiency of secure design reviews is through AI. Models can ingest security standards and patterns and validate implementations against design documents, architecture documents, and source code to determine where and how controls are being applied.

By creating skills and MCP servers to perform these operations, businesses can reduce the need for manual work and enable automation as part of build processes.

For example, an implementation might look like the following:

• An automated secure design review skill runs against the spec, plan, and architecture documents shaping the work.
• Initial feedback is given and incorporated into the requirements.
• Code is written.
• A pull request is made and triggers a CI pipeline.
• The secure design review runs in the pipeline to validate that gaps identified during the design review have been addressed.
• Any additional findings are sent to an ASPM platform through a pipeline MCP-based integration.

By leveraging automation, businesses can get better coverage of secure design review functions in areas where time or resources may be limited, particularly around lower-risk items. Additionally, we can do more to synchronize coverage of controls and standards with ARC platforms such as Dark Defensive.