Security Architecture Review: find design flaws before you go live
Scanners and attack tests usually find design flaws only in the running system. We review your design before you build, migrate or answer an enterprise request. A threat model shows who could attack your system and how. You receive prioritised findings with countermeasures, a target picture and evidence for auditors.
Agreed fixed price from CHF 6'900Findings · target picture · audit evidenceArchitecture Check in 2–3 weeks
Free · 30 minutes · confidential under NDA · read access is sufficient
Law and technology from one engagement. We develop and operate our own platform, pipelines and AI systems. We classify every design flaw under the FADP, NIS2 and the CRA.
For SaaS, mid-sized companies and regulated industries
Lead Auditor ISO 27001 (BSI)
Findings mapped to Annex A
Dr. iur., LL.M., CIPP/E
Legal classification for every finding
Confidentiality & Swiss data residency
NDA, documents kept in Switzerland
Advisory and testing kept separate
credible in front of auditors
Responsible for this engagement
Oliver Stutz
Co-Founder · InfoSec & Cybersecurity Expert · Bachelor of IT (Bond University)
Oliver Stutz is Co-Founder and leads the Security Architecture Review. His team reviews cloud, access rights and software delivery and designs the target architecture. Philipp Staiger, Lead Auditor ISO 27001 (BSI), maps the findings to ISO 27001. The team of Dr. Dominic Staiger classifies every finding under the FADP, GDPR, EU AI Act, CRA and NIS2.
A Security Architecture Review (SAR) checks the design of a system for security flaws, before or during the build. It draws on documents, diagrams, configurations and workshops. It covers data flows, access rights and trust boundaries, meaning borders between areas with different levels of trust. The result is a threat model, prioritised findings with attack paths and a target picture of the secure architecture.
The IEEE Center for Secure Design distinguishes two kinds of error. A bug is an error in the code. A flaw is an error in the design. A penetration test attacks the running system and finds bugs. The review finds flaws. A flaw cannot be patched and becomes more expensive with every component. That is why the review comes before the penetration test.
For apps built with AI tools such as Lovable there is the Security Review for Vibe-Coded Projects. It comes at an agreed fixed price from CHF 3'900. The Architecture Review targets platforms, system landscapes and products meant to grow over years.
When a Security Architecture Review makes sense
A review pays off before an architecture decision or when third parties ask about your architecture.
1
Cloud migration or re-architecture: You are moving to the cloud, restructuring your cloud accounts or breaking up a legacy application. What you now define for accounts, identities and network zones is costly to change later.
2
New platform or new product: You are building a SaaS for many customers or a customer portal. Flaws in data separation and authorisations are far cheaper to fix at the design stage than in operation.
3
Enterprise questionnaire, audit finding or due diligence: A customer, an ISO 27001 auditor or a buyer asks about your architecture. Then you need a robust picture instead of self-declarations.
4
Regulatory obligation or contractual clause: EU customers pass NIS2 duties on secure development and procurement on to Swiss suppliers by contract. DORA requires EU financial entities to design ICT security, not just test it. From 11.12.2027 the CRA requires security from the design stage for products with digital elements on the EU market. The EU Product Liability Directive (EU) 2024/2853 must be transposed by 09.12.2026. It brings strict liability and an eased burden of proof for software. Documented design decisions then support your defence.
5
After an incident or before the pentest: An incident has been fixed, but the structural cause remains: for example a flat network. Or you are planning a penetration test and want to know whether it tests the right architecture.
What sets us apart
Law, engineering and AI development in one team
An architecture review needs three perspectives: attacker, engineer with operating experience and lawyer. Neither a pure law firm nor a classic consultancy can deliver this combination. With us all three work in one team, from the first conversation to the target architecture.
01
Deep legal expertise
Dr. iur., LL.M. and CIPP/E plus Attorney at Law (New York) and Solicitor (UK). Every finding receives a legal classification under the FADP, GDPR, NIS2 and CRA.
02
In-house software engineers
We run our own development centre and the Priverion Platform in Switzerland. So we see where diagram and reality diverge.
03
In-house AI development
We develop and operate our own AI systems, including the legal AI LexCommand. With the experience from securing them, we review the AI in your architecture.
What we review
Every review covers these ten areas. We set the depth during scoping.
Trust boundaries and data flows: We map both per environment and customer. We also set the protection needs per data category (Art. 1 of the Data Protection Ordinance, DPO). From this we build the threat model using the STRIDE method (OWASP ASVS 5.0 V15).
Identity, access and tenant isolation: We review admin and service accounts, multi-factor sign-in and the authorisation model. Each customer needs strictly separated data, keys and logs (ASVS 5.0 V8, DORA Art. 9(4)(c)).
Network and segmentation: We compare your zone concept with the actual firewall rules. The benchmark is zero trust under NIST SP 800-207 and 800-207A: every access is checked.
Cryptography, keys and secrets: We review encryption and key management (ASVS 5.0 V11, CRA Annex I Part I point 2(e)). We look for secrets such as passwords in code, pipelines and configuration.
Cloud landing zone and configuration: We review the basic structure of your cloud accounts and its security baseline. We spot-check against the CIS Benchmarks and the Well-Architected Security Pillar (ISO 27001 Annex A 5.23).
CI/CD and software supply chain: We check whether anyone can tamper with the chain from code to delivery. This includes third-party software and the SBOM parts list (ASVS 5.0 V15.1.2, CRA Annex I Part II point 1). Development, test and production must be separated (ISO 27001 Annex A 8.31).
Logging and detection readiness: We check what is logged where and which attack paths go undetected (ASVS 5.0 V16 and OWASP Top 10:2025 A09). For large-scale processing of sensitive personal data, the logging obligation under DPO Art. 4 applies. Critical infrastructure operators must report cyberattacks to the Federal Office for Cyber Security within 24 hours (Information Security Act Art. 74e). We check whether the logs allow this.
Backup and resilience: Backups must be immutable, out of reach of operational accounts and demonstrably recoverable. We look for dependencies on individual people, systems or providers (DORA Art. 12, Art. 9(3)(b) and (c)).
API and integration design: We review permissions, exposed data fields, access tokens and access for service providers and remote maintenance. We show concentration risks with third-party providers (ASVS 5.0 V4 and V9, NIS2 Art. 21(2)(d)).
AI components: We check access to AI models and agents and data flows to LLM providers. We look for unapproved shadow AI and AI-induced security regressions (OWASP Top 10 for LLM Applications 2025, NIST SP 800-218A). Attack testing is handled by our AI Security Assessment.
We map every finding to ISO/IEC 27001:2022 Annex A, FADP Art. 7 and 8 and GDPR Art. 25 and 32. Findings, risks and evidence can be kept in the Priverion Platform on request and flow into your ISMS.
What a review finds and a scanner does not
Typical findings
Flat network despite a zone concept: The firewall does not enforce the zones. Backups within reach of operational accounts: A hijacked admin account also reaches the backups. Access rules differ in every service: Gaps between services go unnoticed. Customer data separated, keys shared: A single key error hits all customers.
Why the design matters
Three figures from primary sources show that design and configuration determine the extent of the damage. They describe general attack patterns, not your system.
31 %
of confirmed breaches began with an exploited vulnerability, now the most common way in. Network zones, permissions and reachable backups then decide how far the attack spreads (Verizon DBIR 2026).
almost 8 months
is how long third parties took to fix half of their findings: weak passwords and misconfigured permissions (Verizon DBIR 2026).
No. 2
for Security Misconfiguration in the OWASP Top 10:2025. In 2021 it was still No. 5.
Service packages
Three depths of review with entry prices. We agree the fixed price after an initial scoping call.
Architecture Check
Agreed fixed price from CHF 6'900 1 system
Basic review of one system before a pentest or enterprise request. 2–3 weeks, around four consulting days.
Document review: system design, network plan, interfaces, access rights concept
Half-day workshop with architecture, development and operations
Light threat model with data flow diagram: STRIDE checks six types of attack at up to three trust boundaries.
Top 10 findings with countermeasures and a brief legal classification under the FADP. One-page target picture sketch.
PDF report, entries in the Priverion Platform, one-hour closing meeting
Agreed fixed price from CHF 14'000 recommended · platform or 2–3 core systems
For B2B SaaS and mid-sized companies ahead of ISO 27001, enterprise questionnaires or a major tender. 4–6 weeks, 8–12 consulting days. Further systems are quoted separately.
Everything in the Architecture Check
Threat model across all trust boundaries, attack trees for the 2–3 most valuable assets
IAM and tenant isolation, secrets and keys, logging and detection, backup and recovery
Cloud spot checks, the CI/CD delivery chain and the SBOM software parts list
Legal classification by Dr. Staiger's team: FADP, DPO Art. 1–5, GDPR Art. 25, 28 and 32. CRA and NIS2 where they apply.
Executive summary, technical report, target architecture and phased roadmap. Plus risk register and one re-check of your remediation plan.
Agreed fixed price from CHF 30'000 regulated sector · group
For financial services providers, healthcare, suppliers to critical infrastructure and groups with several product teams. 6–10 weeks, 15–25 consulting days.
Everything in the Architecture Review, for the entire system landscape
Zero trust target picture: no access is trusted unchecked. With zone concept, without detailed design.
Catalogue of security requirements for tenders and supplier contracts (NIS2)
CRA conformity roadmap for products with digital elements. Mapping to DORA and FINMA Circular 2023/1 where applicable.
Briefing for the board of directors and executive management on their approval and oversight duty (NIS2 Art. 20). Given by the team led by Oliver Stutz and Dr. Staiger's team, with a 90-day follow-up.
Afterwards you can add the Architecture Advisory Retainer: agreed fixed price from CHF 1'900/month, minimum six months. One review day per month for architecture decisions, threat model upkeep and a seat on your architecture board. We settle the right depth of review in an initial consultation.
How we work
Six steps with a documented result each, without blocking releases.
Scoping
We clarify system boundaries, data categories and the evidence you need. We set out the scope in writing. We agree the fixed price after an initial scoping call. The free initial consultation takes 30 minutes.
Document review and workshop
In a workshop, we compare your documents with practice.
Threat Modelling
STRIDE checks each trust boundary. For personal data, LINDDUN also checks privacy risks. Each risk is either handled or consciously accepted.
Analysis and spot checks
We measure your real architecture against NIST SP 800-207 and the CIS Benchmarks. Plus spot checks in the cloud console, access rights and pipeline. We map attack paths to MITRE ATT&CK.
Report and target architecture
Executive management and the board of directors receive an executive summary. The technical report states severity and measure for each finding. You also get the target picture. Dr. Staiger's team provides the legal classification.
Remediation support
We re-check your remediation plan and update the risk register and evidence in the Priverion Platform. Your security management or your CISOthen takes over. Your team implements, so advisory and testing stay separate.
Why SIDD
What the three disciplines give you:
Experience from our own systems
We make and answer for design decisions like yours ourselves: for the Priverion Platform, our cloud and our AI systems.
Finding plus legal classification
Every finding states its severity and the legal obligation it touches, such as the minimum data security requirements. Anyone who wilfully disregards them risks a personal fine of up to CHF 250'000 (Art. 61 let. c FADP). This is how the results hold up with customers, auditors and the board of directors.
In your auditor's language
We map findings and target architecture to ISO 27001 Annex A. They flow directly into your ISMS, for example into the risk assessment and treatment plan.
Confidential, documents kept in Switzerland
Your architecture documents stay in Switzerland under NDA and a duty of confidentiality. Where Dr. Staiger's team gives legal advice, attorney's professional secrecy also applies (Art. 321 of the Swiss Criminal Code).
Advisory and testing kept separate
If a system we helped design is later to be tested independently, we separate the engagements. This keeps the penetration test credible.
Audit-ready evidence
Findings, risks and remediation status are kept audit-ready in the Priverion Platform. You use them directly for security questionnaires from large customers and for ISO audits.
Vulnerability scan, pentest and review compared
The three assessments complement each other. The review finds the design decision that turns a bug into an incident.
Dimension
Vulnerability scan · penetration test
Security Architecture Review
What is found
Scan: known weaknesses. Pentest: exploitable bugs and attack chains
Why we work with LexCommand, our own Swiss legal AI
LexCommand is our in-house, citation-backed legal AI for the law of Switzerland, Germany, Austria and the EU. Developed and run sovereignly in Switzerland by Priverion GmbH, the company behind SIDD. We do not just preach data sovereignty and provability, we built them into our own tool, alongside the Priverion Platform.
01
Sovereign in Switzerland
The AI runs self-hosted on Swiss infrastructure, with no external cloud LLMs. As an independent Swiss company with no foreign parent, we process your documents in an environment we control.
02
No citation, no claim
Every legal statement traces back to a retrievable primary source, or it does not appear at all. That makes our recommendations auditable and verifiable, instead of merely sounding plausible.
03
From effort to judgement
LexCommand takes over searching, cross-checking and sourcing. That shortens turnaround times and frees our senior advisors for judgement and client dialogue, with no loss of diligence.
04
Three disciplines, one picture
We look at data protection, information security and AI security on a shared source base with a framework crosswalk. So you see overlapping obligations in one consolidated picture, instead of three isolated analyses.
LexCommand cites each finding's legal obligation with its source. A framework crosswalk shows where the same flaw also touches ISO 27001.
Temporally deterministic (as of today or any reference date), with jurisdiction isolation (CH/DE/AT/EU) and a citation verifier at the end of every answer.
Frequently asked questions
What does a Security Architecture Review cost?
Architecture Check for one system: agreed fixed price from CHF 6'900. Architecture Review for one platform or two to three core systems: agreed fixed price from CHF 14'000. Architecture Programme for regulated system landscapes: agreed fixed price from CHF 30'000. We agree the fixed price after an initial scoping call.
How long does the review take?
Architecture Check: 2–3 weeks with around four consulting days. Architecture Review: 4–6 weeks with 8–12 days. Architecture Programme: 6–10 weeks. Your team invests one to four half-day workshops, in parallel with the running project.
What do we need to provide?
We need architecture diagrams, network plans, interface descriptions, your access rights concept (IAM) and any existing risk analyses or pentest reports. For the workshops, you provide one person each from architecture, development and operations. Spot checks need only read access to the cloud console or pipeline, or screen sharing. The workshops close documentation gaps, and security-relevant gaps become findings themselves.
Pentest or Architecture Review: which do we need first?
If your system is still in design or being rebuilt, start with the review. It finds design flaws that a pentest would later only report as a symptom. If the system is already running untested, the penetration testcomes first. If its findings point to the design, the review follows.
Does the review make us ISO 27001, NIS2 or CRA compliant?
No, compliance is never guaranteed and only accredited bodies issue certificates. The review delivers evidence: a design review (ISO 27001 Annex A 8.27) and secure development (NIS2 Art. 21(2)(e)). It also covers secure by design, meaning security from the design stage (CRA Annex I Part I). We support certification in our ISMS consultingand EU supplier clauses in our NIS2 consulting.
What does an outside view add if we have our own security team?
An internal team more easily overlooks the assumptions behind its own decisions. We bring comparisons with other architectures and the legal classification. Auditors and enterprise customers also value independent reviewers. The threat model and target architecture then belong to your team and fit into your ISMS.
Is our certified cloud provider's Well-Architected Review enough?
The provider only secures the infrastructure: you secure accounts, permissions, network rules and keys yourself. This is where misconfigurations arise, which the Verizon DBIR 2025 lists among the three most common error types. The Well-Architected Review checks against the provider's best practices without knowing your business logic and reporting obligations. It still serves as groundwork and shortens our scoping.
We have AI components in our architecture. Review or AI Security Assessment?
Every AI model, every AI search in your documents and every agent with tool access forms a trust boundary of its own. There we check access, data flows, secrets and the transparency obligations of the EU AI Act (Art. 50). From CHF 8'000 per application, the AI Security Assessment then attacks the built system with methods such as prompt injection. If your app was largely built with AI tools, the Security Review for Vibe-Coded Projects is the faster entry point.
What happens after the review?
You receive the report and target picture, plus the target architecture and roadmap from the Architecture Review upwards. During implementation, we re-check your remediation design once and update the evidence. Ongoing design reviews follow in the Architecture Advisory Retainer (agreed fixed price from CHF 1'900/month). Alternatively we run a penetration test before go-live. We also take SaaS providers further towards ISO 27001 and SOC 2 readiness .
This page does not replace legal advice in individual cases.
Find design flaws early and fix them cheaply
In a 30-minute initial consultation, the team led by Oliver Stutz works out the right depth of review with you. A quote follows within 24 hours.
