Designed in. Not bolted on.
Remediating a security flaw found in production costs orders of magnitude more than designing it out before the first line of code. We work at the architecture layer, where the decisions that determine the security properties of a system for its entire lifetime are made.
NIST SP 800-207NIST SP 800-160SABSAISO/IEC 27034STRIDEPASTA
THREAT MODELLING
The core discipline of secure architecture.
Threat modelling makes attack surface visible, drives design decisions, and produces prioritised requirements before implementation begins.
Methodology
- STRIDE · Spoofing, Tampering, Repudiation, Information Disclosure, Denial of Service, Elevation of Privilege; applied per component and per data flow
- PASTA · Process for Attack Simulation and Threat Analysis; risk-centric methodology that ties threats to business impact
- Attack trees · hierarchical decomposition of attacker goals into constituent steps; effective for complex multi-stage attack scenarios
- LINDDUN · privacy-specific threat modelling for systems processing personal data under GDPR or similar obligations
What We Produce
- Data flow diagrams (DFDs) with trust boundaries, assets, and data classification marked
- Threat catalogue: identified threats with likelihood, impact, and risk rating
- Abuse cases: attacker-perspective scenarios tied to design decisions
- Mitigations mapped to each threat with design recommendation or control reference
- Residual risk register: accepted risks documented with rationale
Integration with Development
- Threat model maintained as an architecture artefact and updated at each architecture decision milestone
- Security requirements derived from threat model fed directly into sprint backlog
- Review criteria for code review and testing derived from identified threats
- Developer-facing threat model summary for use in PR reviews and design discussions
ZERO TRUST & DESIGN
Trust boundaries you can actually enforce.
Zero Trust Architecture
- Identity as the control plane · each access decision is anchored to a verified, context-enriched identity regardless of network origin
- Micro-segmentation design · workload isolation at the service level constrains lateral movement, with monitoring used to verify those boundaries
- Least-privilege access patterns · just-in-time and just-enough access models built into the architecture; no standing permissions for sensitive resources
- Device trust integration · device health and compliance status as inputs to access policy decisions
- Continuous verification · access tokens with short lifetimes, session re-evaluation on context change, and anomaly-based re-authentication triggers
Trust Boundary & Service Design
- Service trust boundaries · explicit mapping of which services trust which callers, under what conditions, and with what verification, all documented and enforced rather than assumed
- Tenancy and data isolation models · multi-tenant architecture patterns with cryptographic, logical, and physical isolation options evaluated against the threat model
- Secrets architecture · KMS integration, envelope encryption patterns, secret rotation strategy, and secret injection at runtime rather than build time
- API authorisation design · OAuth 2.0 scope design, token binding, resource server architecture, and inter-service auth (mTLS, SPIFFE/SPIRE)
- Fail-secure defaults · deny-by-default posture, graceful degradation that does not open access on failure, and circuit-breaker design with security implications considered
REFERENCE PATTERNS
Encode it once, default it everywhere.
Reference Architectures & Patterns
- Reference architecture diagrams with security annotations for common patterns: microservices, event-driven, data pipelines, mobile backend
- IaC modules implementing reference architectures with security controls embedded and tested
- Secure-by-default application framework scaffolding eliminating common first-time implementation mistakes
Guardrails & Prevention
- Policy-as-code · admission policies enforcing architecture decisions in CI/CD and Kubernetes admission
- Architecture fitness functions · automated tests that verify security properties of the architecture on each build
- Drift detection · comparison of deployed infrastructure state against approved baseline with alerting on deviation
- Security design review checklist embedded in feature and project planning templates
DELIVERABLES
Durable artefacts, not one-shot consultancy.
Threat Model
- Data flow diagrams with trust boundaries, assets, and classification
- Threat catalogue with STRIDE / PASTA analysis and risk ratings
- Mitigations and residual risk register
- Security requirements derived from threats, suitable for sprint backlog
Architecture
- Security rationale for all significant design choices documented in architecture decision records (ADRs)
- Reference architecture diagrams with security control placement annotated
- Trust boundary specification and service authorisation matrix
- IaC modules implementing approved patterns
Governance
- Security requirements specification tied to threat model findings
- Policy-as-code rules and guardrail configuration
- Developer guidance document: secure design patterns for your stack
- Security review checklist for use in feature planning and PR review
Get a written proposal
Send scope + timeline. Initial response and next steps within 1 business day; proposal timing is confirmed after scoping.
Open the form →
Email a senior practitioner
Direct line for scoping questions. NDA available on request before you share details.
hello@grillisecurity.com →
Active incident?
24/7 incident line. Triage call + retainer set-up inside the hour for new engagements.
+372 5610 1641 →