Scale Security Design Reviews (SDR) for Modern AppSec Teams

The Problem with the Current Approach to Shift-Left

Modern AppSec teams employ various tools to help developers discover and remediate vulnerabilities in the pipeline (SAST, SCA, DAST, etc.). While these tools do a great job at scaling AppSec once developers start coding, none of them get involved in the design phase to help avoid vulnerabilities in the first place.

Involving security teams in the design stage and performing security design reviews (SDR) on every feature helps solve this problem. However, performing SDRs is a manual process that is hard to scale for two reasons:

1. Limited skilled expert engineers – SDRs require experienced security professionals who understand application security and system architecture. Senior AppSec engineers are a scarce resource, making it difficult to scale the process across multiple teams.

2. Unstructured data – SDRs rely on input from architecture diagrams and design documents, which are often unstructured. Before advancements in Generative AI, extracting context from unstructured data in an automated manner was complex and inaccurate.

Seezo SDR addresses these challenges by automating key parts of the SDR process, empowering AppSec teams to provide developers with security requirements before they start writing code — and hence reducing the introduction of vulnerabilities in the first place.

Introduction to Secure Design Reviews

The above problems have led some people to believe that shift-left does not work, and that the right thing to do is to just look for defects in production. We believe the opposite is true: shift-left does not work today because it does not go far enough.

Getting security involved in the design stage — even before the code is written — can solve some of the problems faced with shift-left, such as a high rate of false positives and a lack of context in AppSec results.

Security Design Reviews (SDR) is the process of finding security issues at the design stage and generating security requirements. This helps developers avoid introducing security mistakes into their code.

Today, SDR is typically done manually. While effective, this approach is difficult to scale due to the imbalance between AppSec teams and developers — often as low as 2:100. This imbalance makes it hard to meet the demand for reviews and ensure security requirements are consistently addressed across all development projects.

The rapid proliferation of new technologies such as cloud, AI/LLMs, and web3 further complicates the process. The knowledge required to perform comprehensive security reviews across these evolving domains is highly specialized and difficult to find in a broad set of experts, making scalability even more challenging.

The Seezo Approach

Seezo helps AppSec teams scale Secure Design Reviews (SDRs) by ensuring that every new feature built by engineers undergoes a comprehensive review.

It accepts existing design documents as input, regardless of where they are stored:

• Jira

• PDFs

• Confluence

• Google Docs

• Slack

It can also process architecture diagrams to provide deeper insights. With over 900 pre-defined rules (and support for custom rules), Seezo SDR helps AppSec teams generate relevant security requirements and data flow diagrams.

Key Features and Innovation

Mapping Security Requirements to Compliance Standards

Seezo bridges the gap between security and compliance by mapping security requirements generated during SDRs to relevant compliance frameworks. This ensures that development teams address security risks and align with industry and organizational compliance standards at the same time.

Comprehensive Asset Inventory

Seezo automatically generates an inventory of all assets referenced in the input documents — including cloud components, sensitive data, third-party vendors, and other critical elements. By identifying these assets, Seezo helps teams understand the full scope of potential risks in the design phase.

Over time, the asset inventory created across assessments can be used to derive insights such as:

• What percentage of new features involved the processing of personal data?

• Does any new feature involve the usage of decommissioned components?

In-App Diagramming

Users can create architecture diagrams directly within the Seezo app, leveraging integrations with popular diagramming tools. This enables teams to draw threat models and assess potential vulnerabilities visually, enhancing the clarity and precision of Secure Design Reviews.

Interactive Dashboard to Generate Insights

Seezo's dashboard provides actionable insights from completed assessments, including:

• Time-series data on the number of reviews conducted

• The top 10 risks identified across assessments

• Detailed insights into compliance-related risks

These analytics empower AppSec teams to monitor trends, prioritize risks, and refine their processes effectively.

Customize Seezo SDR to Meet Your Needs

Seezo offers extensive customization options to ensure the SDR process aligns perfectly with your organization's unique requirements:

Understand Company Jargon

During onboarding, Seezo collaborates with your team to learn company-specific terminology commonly used in design documents, architecture diagrams, and workflows. This helps tailor the SDR process to your internal language and ensures accurate analysis.

Write Custom Rules

Seezo allows you to define custom rules, focusing only on the risks and requirements that matter most to your organization. This flexibility ensures reviews are relevant, aligned with your security priorities, and reduces false positives.

Map Requirements to Internal Standards

Most internal standards today are lengthy documents, and dev teams have a hard time understanding the specific security standards they need to comply with for a particular feature. With Seezo, the identified security requirements are mapped to those specific standards automatically — making it easier for developers to address findings in a way that complies with company policies.

Request Integrations for Internal Tools

If your organization uses tools not currently supported by Seezo, you can request custom integrations. This ensures a seamless fit with your existing workflows and minimizes disruptions during adoption.

Technical Architecture

Flexible Deployment Options

Seezo provides deployment flexibility to suit different organizational needs:

• SaaS – hosted on app.seezo.io.

• Self-hosted – deployed on your own infrastructure. Currently supports Azure and AWS, with Google Cloud Platform (GCP) support coming soon.

Intelligent Use of LLMs

Seezo leverages a combination of Retrieval-Augmented Generation (RAG) and decision-tree-based prompt engineering to deliver highly contextual and reliable results. This approach minimizes the risk of hallucination, ensuring outputs are accurate and trustworthy.

Compliance-Ready Solution

Seezo is built with a strong focus on security and compliance. The platform is ISO 27001 and SOC 2 Type 2 certified, giving customers confidence that their data is managed securely and in accordance with rigorous industry standards.

Customer Benefits

100% Coverage on Security Design Reviews

Seezo enables AppSec teams to achieve comprehensive coverage by ensuring every new product feature undergoes a high-quality SDR. This eliminates the need to scale your security team, even as development scales.

Meet Compliance Requirements

Seezo helps organizations fulfill evolving compliance obligations, including "Secure by Design" mandates and regulations from authorities like the FDA, MAS, and SEBI. By integrating SDRs into application development, teams can proactively meet these requirements.

Data Privacy and Security

Seezo prioritizes customer data security. Whether you choose the SaaS deployment or opt to self-host, your data is never used for model training. This ensures complete control and confidentiality of sensitive information.

Case Studies

Empowering Product Security Teams in Fintech

A leading Southeast Asian fintech company leveraged Seezo to automate their manual SDR process. The Head of Product Security actively championed Seezo's adoption, recognizing its potential to streamline security workflows and improve collaboration with developers.

The platform accelerated the SDR process and received public appreciation from leadership, who highlighted its effectiveness in a LinkedIn post. Following these early successes, the organization initiated discussions for a trial agreement to embed Seezo more deeply into their workflows.

Accelerating SDRs in a Mid-Market Healthtech Firm

A U.S.-based healthtech company, valued at over $7 billion, sought to replace their manual SDR process with Seezo to reduce turnaround times and improve accuracy. By integrating Seezo with Slack and automating the review of design documents, the company achieved significant efficiency gains — completing reviews in just 10 minutes, compared to the 3 hours required by human assessors.

Even without customization, Seezo identified nearly half of the security issues found manually. Plans are underway to integrate Seezo into their Technical Design Documentation (TDD) workflows for consistent and scalable SDRs.

Meeting Compliance Requirements for a Large Payments Provider

India's largest payments company integrated Seezo to enhance its security design reviews and meet regulatory compliance requirements. Seezo's outputs were included in a critical compliance audit, showcasing how automated design reviews are now a key part of the company's security program.

The solution was used to process every technical specification document uploaded to Jira, with results aiding pentesting teams and being shared as actionable security requirements for developers. The company is now expanding Seezo's role within its software development lifecycle (SDLC).

Roadmap

Expand Integrations

Seezo SDR is built to be easy for AppSec teams to use, without requiring developers to access the platform directly. Integrations are key to ensuring AppSec teams can interact with developers on their own tool stack. We currently integrate with:

• Google Drive

• Notion

• SharePoint

• Confluence

• Jira

• Slack

• Lucid

• ServiceNow

We will continue to add more to incorporate Seezo into existing workflows and ensure a seamless SDR process.

Guidelines for Verifying Security Requirements

Seezo will soon offer tailored guidelines for verifying security requirements based on your internal workflows. These could include:

• Penetration Testing checklists

• Static Application Security Testing (SAST) rules

• Abuse cases

• Cloud Security Posture Management (CSPM) rules

Together, these enable comprehensive validation of security measures.

Enhanced Diagram Customization

Customized components will be added to input diagrams, allowing teams to model unique architectures directly within the Seezo platform. This will improve the precision of Secure Design Reviews and make threat modeling even more adaptable.

Custom Rule Editor

Seezo's roadmap includes a custom rule editor, enabling teams to write and deploy their own rules for scans. This provides greater control over what is analyzed during SDRs, ensuring results align perfectly with your organization's security needs.

Evaluate Seezo in Your AppSec Workflow

See how design-time security decisions can be applied consistently across a high volume of architectural changes — without adding headcount or changing developer workflows.

Book a walkthrough →