The architect
Security Architect
@security_architect
Reviews the architecture, finds the gaps, and walks you through your system's security profile.
Catch security flaws while they are still a line in a design.
Himaya reviews your stories, designs and code changes the way a security architect would. Each team learns what could go wrong and what to build to stop it, from the first story to the release.
Private beta. Open to selected customers only.
Criteria land on the story before anyone builds it.
Himaya reads a new story against the system's design review and writes security acceptance criteria straight into the Azure Boards work item. The product team never has to log in.
Himaya reads
As an applicant, I want to upload my payslips so that my loan can be assessed.
Added to the story
Threats are found while the design is still a drawing.
Himaya works out where data crosses a trust boundary, the line between parts you trust differently, and what could go wrong there. Each threat comes with the requirement that stops it.
Himaya reads
- Loan origination design.docx
- System context diagram.png
- Loan API specification.yaml
Threats found
Specs and code stay in step with the review.
Developers and their coding agents ask Himaya which criteria apply to the spec they are about to build. When the code changes, the design review updates with it.
Himaya reads
$ himaya review-spec upload.md
touches API gateway
Document store
added 3 criteria to the spec
The developer gets
The running app is checked against what was asked for.
After each release to your test environment, Himaya tests the running app against the stories' criteria. It reports a problem only when a live attempt proves it and a replay confirms it.
Coming next. This stage is in development and not yet part of the beta.
Himaya reads
- The release in your test environment
- The stories and changes in that release
- Test accounts your security team sets up
Results
One finding, written for everyone who has to act on it.
Every threat Himaya raises has the same five parts, and each part is written for the person who needs it. Point at a reader to see their part.
- Threat
- A payslip carrying malware is stored, then opened by a loan officer.
- Where it came from
“Uploaded files are written to storage and queued for scanning.”
Loan origination design, section 4.2- What stops it
- Scan every upload before it is stored. Keep files that fail the scan away from staff.
- How to check
- Upload the standard antivirus test file. It must be rejected and never appear in a loan officer's queue.
- Standards
- OWASP ASVS 5.0, V5.4.3NIST SP 800-53, SI-3
- Product owners
See the risk in plain words and decide what to fix first.
- Security reviewers
Check each point against your own document in seconds.
- Developers
Get a requirement they can build, not a category name.
- Testers
Get a check they can run and a result they can record.
- Auditors
See which standard each requirement meets.
A crew of specialists that knows your system.
Ask in chat with an @ name. Each agent reads the same project, so their answers start from your design, not from a blank page.
The coder's ally
Secure Coding Advisor
@secure_coding_advisor
Researches the technologies your project uses and writes the secure coding rules your coding agents follow.
The privacy lead
Data Privacy
@data_privacy
Finds privacy gaps and personal data risks under GDPR, CCPA, HIPAA and DPDP, and drafts the questions for your legal team.
The risk owner
BISO
@biso
Your business information security officer. Frames risk for leadership, risk acceptance and the story you tell auditors and regulators.
Also on hand: Himaya, your guide, who answers questions about the project and sends you to the right specialist, and Ask Himaya, which answers product teams' questions inside Azure DevOps.
Made for teams who answer for security.
Four things every customer asks before the first review.
Himaya is in private beta, open to selected customers.
We are working with a small number of teams so each one gets our full attention. Tell us how your team reviews designs today, and we will tell you whether the beta is a fit.