Security Architecture Review
A security architecture review puts engineering input into a design before it is built, while changing it is still cheap. We work through the architecture with the team that owns it, identify the decisions that carry security consequences, and leave behind patterns the team can apply to the next system without asking again.
Security Engineering & Research — practice area
What the engagement covers
Design-stage consultancy for engineering teams building new systems.
Trust boundaries
Where the design crosses from one level of trust to another, what is assumed at each crossing, and what actually enforces the assumption.
Identity and authorisation model
How the system establishes who is calling and what they may do, assessed at the design stage, while an authorisation model is still cheap to change.
Data handling
What the system collects, where it is stored, how long it is kept, and which components can reach it, assessed against the sensitivity of the data and the obligations attached to it.
Failure and abuse cases
How the design behaves when a component fails, a dependency is unavailable, or an input is hostile, and whether the resulting failure mode is a safe one.
Reusable patterns
The decisions worth fixing as a standard — authentication, secret handling, service-to-service trust — so later systems inherit them rather than resolving them individually.
How we do it
Scope is agreed in advance and documented in a statement of work before any work begins.
01
Design intake
We review the design material the team already holds and work through the intended system with the engineers who designed it, rather than from documentation alone.
02
Threat-led review
We work through the design against the threats that apply to it, identifying where a decision creates exposure and what the alternatives would cost.
03
Decisions and patterns
Recommendations are written as decisions the team can act on, each with its rationale, and the generalisable ones are captured as patterns for later work.
What you receive
Written so findings can be assigned directly to the teams that will act on them.
Architecture review record
The design as reviewed, the trust boundaries and threats identified, and the security consequence of each significant decision.
Recommendations
Specific, actionable changes to the design, each with its rationale and its cost, separated into what to change before building and what to revisit later.
Security pattern set
The reusable patterns the review established, written so the next system in the same environment can adopt them directly.
Also in Security Engineering & Research
Architecture consultancy and vulnerability research on technologies you depend on.
Applied Vulnerability Research
Technical analysis of third-party systems prior to adoption or investment.
Frequently asked questions
- When in a project should a security architecture review happen?
- At design stage, before implementation begins and while the architecture can still change cheaply. The engagement is structured around design review rather than post-implementation findings, so the earlier it runs the more of its output can be acted on. Reviews of systems already built are still useful, but the options available narrow considerably.
- How is this different from a penetration test?
- A penetration test examines a running system and reports the vulnerabilities present in it. An architecture review examines a design and addresses the decisions that would produce vulnerabilities once it is built. The two are complementary: the review reduces what a later test finds.
- Do you work alongside our engineers or hand over a document?
- Both. The review is conducted with the engineers who own the design, because the reasoning behind each recommendation matters more than the recommendation itself. The written record and the pattern set remain afterwards, so the work outlives the engagement.
Scoping this engagement
Send us the systems in scope and the outcome you need. We will respond with a proposed scope, timeline, and commercial terms.
Request a proposal