| name | secure-by-design-program |
| description | Establish or assess an org-wide secure-by-design program — paved roads / golden paths with secure defaults, automated guardrails, and developer enablement — so the secure way is the default, fast way. Use for engineering-org security strategy at scale (not a single system's design). |
Goal
A program that makes security the path of least resistance across the engineering
org: secure defaults built into platforms and templates, guardrails that prevent
classes of issues automatically, and developers enabled to build securely without
friction.
Pillars
- Paved roads / golden paths — blessed, secure-by-default templates, platforms,
and libraries (service scaffolds, hardened base images, IaC modules, auth/secrets
handled for you). Make the secure choice the easy default.
- Guardrails (automated) — policy-as-code and platform controls that prevent or
catch whole classes of issues: CI/CD gates (
security-engineer:secure-pipeline),
admission control (k8s-security), org-wide cloud guardrails (cloud-security),
secure defaults that are hard to turn off.
- Developer enablement — security champions program, self-service security
tooling, just-in-time guidance, threat-modeling-as-a-habit (
threat-modeling),
and training that targets the org's real defect patterns.
- Shift-left integration — security built into the SDLC and developer workflow,
not bolted on; fast, actionable feedback in the tools devs already use.
- Measurement — adoption of paved roads, guardrail coverage, escaped-defect and
mean-time-to-remediate trends; measure the program by outcomes, not policies.
Steps
- Assess the current state: where security is friction vs. default; common defect
classes; existing platforms/templates.
- Design paved roads and guardrails that eliminate the top defect classes by default.
- Plan enablement (champions, self-service, training) and shift-left integration.
- Define adoption/outcome metrics and a phased rollout.
Output
A secure-by-design program plan: paved roads · guardrails · enablement · integration ·
metrics · phased rollout. Use security-reporting; diagram the target developer/
platform flow with security-diagramming.
Notes
Make security the default, not a gate to argue with — friction that developers route
around isn't security. Eliminate whole classes of issues via paved roads and
guardrails rather than finding them one by one. Measure adoption and escaped defects,
not the existence of a policy.
