From the design
A first threat model from the solution design, before code exists. Every fact traces to a quote in the source.
Continuous security assurance for the AI era
Ship at AI speed. Secure at the same speed.
AI lets teams build in days what used to take months. Skip the threat model and you ship the vulnerabilities, and attackers have AI too. Crux turns your design documents into a cited threat model, then scopes the security testing to match, so assurance keeps pace with the build. AI drafts. You decide.
- Cited architecture
- Credible threats · in development
- Security test scope · in development
- Test scripts · coming
Built for security architects, risk owners and the engineers they review with.
01 · SourcePages 4 to 9
3.1 Client to API
Page 4
The mobile app sends payment requests to the Payments API over TLS 1.2. Requests are signed with a per-install key.
4.2 Card data
Page 6
Card numbers are never stored by the API; it exchanges them for tokens held in the Token Vault.
6 Settlement
Page 9
A nightly job transmits settlement files to the bank over SFTP.
02 · Proposed factsAI proposes
03 · ArchitectureSource-linked
Selected: Mobile App calls the Payments API over TLS 1.2. Its source quote is highlighted on page 4.Sample data. Not a real customer or assessment.
01
Every fact cites its source
Quotes are checked against the registered document. No quote, no fact.
02
AI proposes, people decide
Nothing is accepted or approved until a person says so.
03
Analysed only after you confirm
Your documents go to the AI model only when you confirm an analysis.
04
Every decision recorded
Who accepted, rejected or approved, and when, stays in the history.
The speed gap
Building got faster. Reviewing did not.
AI coding tools have changed how quickly a design becomes a product. The threat model, the controls and the sign-off still run at the old pace, or get skipped.
01
Development sped up
A team can now go from idea to a working service in days. The design changes as fast as the code does.
02
The review stayed manual
Reviewers rebuild the picture from documents and chat threads each time. Under deadline pressure the threat model is rushed, or skipped.
03
Attackers sped up too
The same AI tools help others look for weak spots in what you ship. A gap that used to stay hidden for months can be found quickly.
Illustration of the idea, not measured data.
52%
of teams name manual review as a bottleneck in AI-assisted development.
Black Duck, 2026831 engineers and DevOps professionals
66%
of security practitioners spend over half their time manually validating findings.
ProjectDiscovery, 2026200 security practitioners, North America and Western Europe
44%
of AI code-generation tasks produced code with a known vulnerability in one benchmark.
Veracode, 202680 tasks, 4 weakness types. Code-level, not design-level
120 to 80
days: median time from CVE publication to known exploitation, 2025 to first half of 2026.
VulnCheck, 2026495 known-exploited vulnerabilities
Vendor-published research, with the scope under each figure. These describe trends in the industry, not results from Crux.
Four ways in
Four ways in. One threat model.
A scanner looks at code. A threat model looks at the system: what it is meant to do, who could abuse it, and what a change does to that. Crux builds and updates the model from the design, the code, or both.
From the code
Read the code for what it actually does, and check it against the design’s assumptions, including what the documents never mention.
From both
Compare what was intended with what was built. The model sets the security testing scope: what should be tested for this project, and why.
When something changes
A design update, a code change, or both. Crux re-checks the affected threats and test scope, and shows what needs another review.
Code scanners (SAST, SCA) ask
Does this code or dependency match a known flaw pattern?
A threat model asks
What could go wrong with this system, given what it is for, and has this change altered that?
All four are in development. The design-based work builds on the evidence and architecture stages available today. Scanners stay useful, and Crux is meant to work alongside them. The difference between design flaws and implementation defects is described in OWASP Top 10 A06: Insecure Design.
End to end
One continuous loop, from evidence to retest.
Threat modeling is not a document you file. Crux carries the same evidence through threats, test scope, test scripts and findings, and is built to run again when the design or the code changes.
Labels show what exists today. Test scripts, findings and retests are being built.
How it works
From design document to tested design, without starting from scratch.
Crux follows how a security review actually runs, and does the first draft of each stage, from evidence through to test scope. Each stage builds on the one a person has already reviewed.
Speed you can trust
No quote,
No quote,
no fact.
Fast is only useful if you can check it. When Crux proposes a fact, it has to point at the words in your document. If it cannot find them, the proposal does not become a fact. Reviewers verify in seconds instead of re-reading everything.
Payments API swaps card numbers for tokensQuote found
“Card numbers are never stored by the API; it exchanges them for tokens held in the Token Vault.”
partner-payments-design-v3.docx · page 6 · §4.2
API Gateway enforces mutual TLSNot accepted
“The gateway requires client certificates on every request.”
quote is not in the source
Sample data. Not a real customer or assessment.
Credible threats
Threats that earn their place, not checklists.
A threat is only raised when there is an actor, a weakness, a path and a material consequence. Crux does not force every category onto every flow.
Threat · Mobile App to Payments APIPartly addressed
A captured payment request is replayed
- Actor
- Attacker on a shared network
- Weakness
- Payment requests carry no one-time value
- Path
- Capture a signed request, send it again
- Consequence
- Duplicate charge for the customer
Outcome control. The service must reject any request whose idempotency key it has already seen.
Considered, not raised
RepudiationNo credible actor and consequence on this flow
Information disclosureCovered by TLS 1.2 (page 4)
Sample data. Not a real customer or assessment.
1
Actor
Someone who can really act against this flow, not a generic attacker.
2
Weakness
A specific gap in the design, tied to a cited fact.
3
Path
How the actor reaches that weakness, step by step.
4
Material consequence
An outcome that matters to the business, in plain words.
→
An outcome control and a gap status
Controls say what the service must do to break the path. Gaps say whether the design addresses it fully, partly, or not at all.
Security assurance testing
Know what to test, and why.
A threat model that stops at a document leaves the next question open: what should we actually test? Crux scopes the security testing from your approved threats, and is being built to draft the tests too.
Test scope · Payments flowIn development
T-1High
Replay a captured payment request
Expect rejection · traces to threat: replayed payment p.4
T-2Medium
Change the amount in transit
Expect signature failure · traces to threat: request tampering p.4
T-3Medium
Call the Payments API without the app signature
Expect 401 · traces to threat: unauthenticated caller p.4
T-4Low
Try to read stored card numbers
Expect only tokens · traces to fact: card numbers never stored p.6
Sample data. Not a real customer or assessment.
Sample content. Test scope and test scripts are in development and are not available in Crux today. Every test is meant to trace back to a threat and the source fact behind it.
You stay in control
The reviewer makes every call.
Accept or correct
Review fact by fact
Accept what is right, edit what is close, reject what is wrong. Each choice is kept.
AcceptedMobile App calls the Payments API
To reviewSettlement job sends files nightly
Approve
Approval with a name and a time
Approving records the signed-in person. Only people with the approver role can do it.
AR
Approved by A. Reviewer
25 Oct 2026 · 10:42
Keep and share
History and export
See what changed and who changed it. Export the review as a Word document for the people who need it.
10:42 architecture approved
10:31 2 facts accepted
10:18 analysis completed
Export .docx
10:31 2 facts accepted
10:18 analysis completed
Export .docx
Security and privacy
Your documents are the sensitive part. We treat them that way.
Where sign-in data is stored, and which providers process it, will be listed on the privacy page before launch. We do not claim certifications Crux does not hold.
Review your next design before it ships.
Your team is building faster. Tell us who you are and what you review, and we will reply with access and a short walkthrough.
- Start from the documents you already have
- See every fact next to its source
- Keep the final call with your reviewers