{"slug": "where-does-secure-by-design-end-a-3d-4d-model", "title": "Where does Secure by Design End? A 3D/4D Model", "summary": "A developer proposes a 3D/4D model for Secure by Design, distinguishing between designing a system to be secure (3D: Design, Define, Determine) and demonstrating that the implementation is secure (4D: add Demonstrate). The model aims to provide architectural context for AI-assisted development and autonomous agents.", "body_md": "I’ve been thinking about a surprisingly intricate question:\n\nThe term now covers everything from threat modelling and architecture reviews to secure development, vulnerability scanning and assurance.\n\nAll of these are important, but I think there is value in separating designing a system to be secure from demonstrating that the implementation actually is secure.\n\nI’ve been using a simple model for this.\n\n[The 3D Method for Secure by Design](https://isecurebydesign.com/news/how-to-secure-by-design)\n\nThe design-time process has three steps:\n\nCreate a sufficiently accurate representation of the intended system so that it can be analysed.\n\nThis might be an architecture diagram, model or specification. The important point is that it represents architectural intent, rather than being reconstructed from whatever was eventually implemented.\n\nThis distinction becomes particularly important with AI-assisted development. If probabilistic AI creates the implementation and another probabilistic AI reconstructs the architecture from that implementation, our security analysis is increasingly based on inferred rather than governed intent.\n\nDefine the security objectives for the system.\n\nThere are several ways to do this, including:\n\nI don’t think these approaches need to compete.\n\nThreat modelling is particularly useful for discovering non-obvious risks. Asset-level risk assessment can provide a scalable way of establishing security objectives, while policies can provide repeatable organisational expectations.\n\nDetermine the controls required to meet those objectives.\n\nThis is where I think context becomes particularly important.\n\nA control shouldn’t just say what must happen. Ideally we retain why the control exists and what architectural element it applies to.\n\nThat gives us something that can be communicated to human developers, AI coding assistants and eventually autonomous development agents.\n\nAt this point, I would argue that Secure by Design is complete.\n\nWe have described what we intend to build, established its security objectives and determined the controls required to achieve them.\n\nBut we haven’t demonstrated that the resulting system actually does any of those things.\n\nThe Fourth D: Demonstrate\n\nThis leads to an optional fourth step:\n\nDemonstrate that the implemented system actually realises the design and its controls.\n\nThat could include:\n\nThis creates a distinction I’ve found useful:\n\n3D determines what a securely designed system should be. 4D extends this into secure delivery by demonstrating that the implementation actually realises the design.\n\nSo:\n\n3D Method — Secure by Design\n\nDesign → Define → Determine\n\nand:\n\n4D Method — Secure Delivery\n\nDesign → Define → Determine → Demonstrate\n\nI think this distinction becomes more useful as AI agents take a larger role in software delivery.\n\nAn agent doesn’t just need a list of controls. It needs enough architectural context to understand what those controls apply to and why they exist.\n\nAnd if an agent participates in implementation, we need a way of evaluating whether what it produced still conforms to those decisions.\n\nDoes the distinction hold?\n\nThis is the part I’m interested in getting feedback on.\n\nWould you consider Secure by Design complete once the required controls have been determined?\n\nOr should demonstrating that those controls were implemented correctly remain part of Secure by Design itself?\n\nI’ve written up the longer version, including how it evolves with AI:", "url": "https://wpnews.pro/news/where-does-secure-by-design-end-a-3d-4d-model", "canonical_source": "https://dev.to/adbc99/where-does-secure-by-design-end-a-3d4d-model-j14", "published_at": "2026-07-25 14:35:56+00:00", "updated_at": "2026-07-25 15:01:15.917848+00:00", "lang": "en", "topics": ["ai-safety", "ai-agents", "developer-tools"], "entities": [], "alternates": {"html": "https://wpnews.pro/news/where-does-secure-by-design-end-a-3d-4d-model", "markdown": "https://wpnews.pro/news/where-does-secure-by-design-end-a-3d-4d-model.md", "text": "https://wpnews.pro/news/where-does-secure-by-design-end-a-3d-4d-model.txt", "jsonld": "https://wpnews.pro/news/where-does-secure-by-design-end-a-3d-4d-model.jsonld"}}