Security Architect

STRIDE threat modeling systematically identifies security risks across six categories—Spoofing, Tampering, Repudiation, Information Disclosure, Denial of Service, and Elevation of Privilege. This Skill automates threat modeling to surface vulnerabilities before deployment, helping you design defenses aligned to each threat category.

OWASP Top 10 protections address the most critical web application vulnerabilities—injection, broken authentication, sensitive data exposure, XML external entities, broken access control, security misconfiguration, cross-site scripting, insecure deserialization, using components with known vulnerabilities, and insufficient logging. This Skill embeds these defenses into your architecture and code.

Compliance requires mapping security controls to regulatory frameworks. This Skill automates compliance reviews by connecting threat modeling, secure design practices, encryption, key management, and audit logging to specific GDPR, HIPAA, SOC2, and PCI-DSS requirements, reducing manual assessment overhead.

Yes. This Skill applies threat modeling and secure design reviews throughout the development lifecycle—during architecture assessment, code review, and compliance checks. It works across web, mobile, and cloud-native environments to catch security gaps before production.

Defense-in-depth layers multiple security controls so no single failure exposes the system; point controls protect individual components. This Skill designs defense-in-depth architectures using encryption, key management, audit logging, and secure authentication to create resilient systems resistant to cascading failures.