Learning to build an effective security design review program
summary
Over two years and about ~400 design reviews for a 500‑developer org the team builds a repeatable program: automated intake from the feature roadmap, a five‑minute survey to capture risk flags, tech‑lead human triage to avoid false positives, and focused security threat models for ~150 deep reviews, yielding an NPS of 52. Models (Claude) are tested for threat‑modeling with back‑testing against 20+ human reviews. All replication materials and scripts are released.
AI-written summary · about
chapters (8)
- 0:00Security design review intro
- 1:49Program mission and results
- 5:01Program evolution
- 12:45Hybrid approach and triage
- 15:41LLMs in secure reviews
- 18:11Program design pitfalls
- 24:53Successful program traits
- 29:39Q&A
related talks
43mDeveloper Driven Security In High-Growth Environments
20mBuilding security culture on infrastructure teams
17mA Sneak Peak Into Security Reviews with the Community
38mBuilding a Security Assurance Program
52mLessons From The Threat Modeling Trenches
24mBeing secure by design: Engineer-led security
31mSharing Security Secrets: How to Encourage Security Advocates
01h 00mImproving the Chances of Success in Secure Software Development