Where does Secure by Design End? A 3D/4D Model

The article proposes a 3D Secure by Design model: design, define, and determine the required controls.

It argues that the core Secure by Design process ends at specifying what security controls are needed.

A separate optional fourth step is added to validate that the implemented system matches the intended design and controls.

This distinction matters because designing for security is not the same as proving the system is secure, especially with AI-assisted development.