Architecting Security

It pushes you to run STRIDE, PASTA, or LINDDUN threat modeling before you ship new systems or cross trust boundaries, then map controls to SOC2, PCI, HIPAA, or GDPR requirements with evidence chains. The routing splits cleanly into threat modeling, identity and zero trust (IAM, SSO, MFA, PAM), and compliance artifacts. The decision matrix is sharp: SAML for enterprise SSO, OIDC for APIs and mobile; FIDO2 when phishing is a real threat; JIT privilege access for production. The iron law is worth repeating: threat list before code, controls must be evidence-backed, and residual risk goes in the design doc with explicit acceptance. It won't write policies for you, but it'll make you answer the right questions before your next security questionnaire lands.