Threat modeling is a structured way to identify what could go wrong with a system's security during design. Teams then decide which risks to mitigate before code is written.
DevSecOps is the practice of building security checks into everyday software delivery. Code, dependencies and infrastructure are tested automatically on every change instead of being reviewed only before release.
A technical specification is a document that explains how a feature or system will be built. It covers architecture, data, interfaces, risks and trade-offs, so engineers can agree an approach before coding.
AI security is protecting AI systems, their models, data and connected tools from attack and misuse. It also covers the new risks that AI adoption brings to the rest of the business.
An attack surface is the total set of points where an attacker could try to enter or extract data from a system. It spans exposed services, code, identities, devices and people.
ISO 27001 is an international standard for building and running an information security management system (ISMS). Organisations can be formally certified against it by accredited bodies.
A security engineer designs, builds and maintains the controls that protect an organisation's systems, applications and data from attack. Companies often hire one when enterprise customers, audits or rapid growth raise the stakes.
A clear proven process, that delivers
You've seen our ideas - now go deeper.
Discover more insights, guides, and engineering practice.