Skip to content
Coming soon SBDaaS is on its way. This page previews the product — the live service isn't available yet.

SBDaaS · Automated threat modelling · A JQiT product

Secure by Design as a Service.

Security should not be an afterthought. It should be built in from the start.

SBDaaS is a guided, AI-assisted secure-by-design system that helps teams understand and model security risks before a single line of code reaches production.

It transforms complex security frameworks into a structured, self-service workflow — mapping threats, controls, and compliance requirements into a clear, actionable model tailored to your environment.

Instead of reactive security reviews, SBDaaS builds security thinking directly into design and delivery.

It is the same secure-by-design approach used in high-assurance environments, now made accessible, repeatable, and scalable.

Design securely from the beginning. Deliver with confidence.

Open SBDaaS ↗ Talk to an architect
NIST AI RMF STRIDE STRIDE-AI OWASP Top 10 OWASP Top 10 for LLM Applications

How it works

Three tiers, one pipeline.

01 · INTAKE

Scope & gather

Choose a solution security assessment, a vendor risk assessment, or both, and tell us your industry. SBDaaS scopes to the matching regulatory-compliance or best-practice framework, issues a control-based questionnaire, and collects the responses with your solution-design document.

→
02 · ANALYSIS

Model & map

From the questionnaire and design, SBDaaS builds a threat model, maps every control back to the chosen framework, and rates inherent and residual risk against your risk & impact matrices — informed by current breach patterns.

→
03 · OUTPUT

Assess & advise

You get a board-ready assessment outcome — deviations flagged against the framework, each with a prioritised remediation recommendation. For deeper work, an optional JQiT consulting engagement extends the assessment.

The Secure by Design lifecycle

Secure by Design

Least privilege · Defence in depth · Secure by default · Minimise attack surface · Simplicity

  1. 01

    Security Requirements

    • Regulatory and compliance requirements
    • Privacy and data classification
    • Control baselines and requirements traceability
  2. 02a

    Vendor Risk

    • Vendor risk profiling
    • SBOM / software provenance
    • Supply-chain security
    • Contractual security clauses (SLAs, right-to-audit)
    02b

    Architecture

    • Threat model (STRIDE / STRIDE-AI)
    • Architecture and data-flow diagrams
    • OWASP and AI control selection
    • Control-to-design mapping
  3. 03

    Design Assurance

    • Gate design with IAM, CMDB
    • Secure configuration baselines
    • Documented risk acceptance
    • Design review sign-offs
  4. 04

    Build Assurance

    • CI/CD security gates
    • SAST / DAST
    • Host / container scanning
    • Secrets management
    • Change management
  5. 05

    Runtime Assurance

    • SOC & SIEM integration
    • DLP, EDR
    • Vulnerability management and patching
PCI-DSS CPS 234 Essential 8 ISM PSPF SOCI NIST CSF ISO 27001 SOC 2 NIST AI RMF ISO 42001 OWASP Top 10 OWASP Top 10 for LLMs

The mapping matrix

sbdaas://secure-by-design/control-matrix 6 phases · frameworks → controls → evidence
Lifecycle phase Primary frameworks Secondary / cross-cutting Key controls & evidence Enterprise best practices
01
Security Requirements & Compliance
PCI-DSSCPS 234PSPF
NIST CSFISO 27001SOC 2Essential 8
  • Policy documents
  • Regulatory mapping matrix
  • Control baselines
  • Risk register
  • Data classification
  • Privacy impact assessment
  • Legal & regulatory register
  • Control-owner assignments
  • KPIs / metrics (KRIs & KSIs)
02a
Vendor & Supply-Chain Risk Management
SOC 2ISO 27001SOCI
NIST CSFCPS 234PCI-DSS (vendor clauses)
  • Vendor due diligence
  • Contracts & SLAs
  • Supplier risk assessments
  • Attestation reports
  • SBOM / software provenance
  • Third-party security questionnaires
  • Continuous vendor monitoring
  • Source-code escrow & right-to-audit
02b
Security Architecture & Threat Modelling
NIST AI RMFISO 42001OWASP Top 10
OWASP LLM Top 10NIST CSFCIS Controls
  • Threat models (STRIDE / STRIDE-AI)
  • Architecture & data-flow diagrams
  • Trust-boundary definitions
  • Control-to-design mapping
  • Zero-trust principles
  • Threat-intelligence integration
  • Abuse & misuse cases
  • Attack-surface minimisation
03
Design Assurance & Risk Governance
ISO 27001NIST CSFEssential 8
ISMPSPFCIS Benchmarks
  • Design review minutes
  • CMDB entries
  • IAM design artefacts
  • Documented risk acceptance
  • Formal design-review gates
  • IAM standards (SSO, MFA, PAM)
  • Encryption & key-management policy
  • Secure configuration baselines
04
Secure Build & Implementation Assurance
OWASP Top 10OWASP LLM Top 10Essential 8
ISMCIS BenchmarksMicrosoft SDL
  • SAST / DAST reports
  • CI/CD security gates
  • Adversarial robustness tests
  • Change records
  • Secure coding standards
  • Peer code review
  • Secrets management
  • Container image scanning
  • SBOM in CI & dependency scanning
  • Pre-prod red / blue / purple testing
05
Runtime & Operational Security Assurance
NIST CSFPCI-DSSSOC 2
PSPFISO 27001CIS Controls
  • SIEM / SOC alerts
  • DLP logs
  • Vulnerability tickets
  • Audit reports
  • 24/7 SOC & incident-response playbooks
  • Patch-management SLAs
  • Runtime protection (RASP, EDR)
  • Drift & model monitoring for AI
  • Backup & DR tests
  • Posture management (CSPM / CNAPP)

Each lifecycle phase scopes to the regulatory and best-practice frameworks above — the control baseline behind every threat model and assessment SBDaaS produces.

How an SBDaaS run flows

Start
  1. 01

    Choose the assessment

    Scope the run to what you need to prove.

    Solution security assessment or Vendor risk assessment or Both
  2. 02

    Select your industry

    SBDaaS scopes the run to your sector's obligations.

  3. 03

    Scope the control set

    Driven by your industry, the solution and/or vendor track is scoped to the right baseline:

    Regulatory & compliance requirements or Industry best-practice framework
  4. 04

    Issue the questionnaire

    A regulatory- or framework-control-based questionnaire is sent out.

  5. 05

    Collect the inputs

    Questionnaire responses come back, together with your solution-design document.

  6. 06

    Build the threat model

    STRIDE / STRIDE-AI modelling over the design and the responses.

  7. 07

    Map the controls

    Every control mapped back to the chosen regulatory or framework baseline.

  8. 08

    Assessment outcome

    Deviations flagged against the framework, each with a prioritised remediation recommendation — exported board-ready.

  9. Deeper engagement

    Optional add-on

    For in-depth work, a JQiT consulting engagement can be organised to extend the assessment.

From method to machine

Our threat-modelling practice, automated.

For years JQiT has produced threat models by hand — reading an architecture, weighing it against threat actors and real-world breaches, and mapping controls to the standards a client must meet. SBDaaS productises exactly that workflow.

You bring the system description and your own libraries — security standards, threat actors, threats, controls, and a risk assessment. SBDaaS reasons over them and produces the deliverables a security architect would, in minutes rather than weeks.

The hands-on consulting engagement remains available — SBDaaS is the self-serve tier of the same practice. Prefer it done with you? Talk to us →

Deliverables

What every run produces.

Governed, consistent, audit-ready outputs — the artefacts a security review actually needs.

Prioritised threat table

Risk summary, threats, actors, vectors, inherent risk, proposed controls and residual risk — ranked by likelihood, impact and real-world relevance.

Risk assessment

Threats mapped to known attacker techniques, so coverage and concentration are obvious at a glance.

Standards-mapped controls

A controls library with ID, toolset, configuration requirements and implementation status — each control mapped to the standard it satisfies, and gaps called out.

Board-ready export

Everything compiled into a clean, landscape document your risk committee can read — and your engineers can action.

Justified risk ratings

Ratings reasoned against your risk assessment and impact matrix, with a high-level rationale citing the recent breaches that informed them.

Repeatable & versioned

Re-run as the architecture evolves; outputs stay consistent, comparable and traceable across versions.

Knowledge base

A catalogue of AI threats, mapped to frameworks.

The threat intelligence behind every SBDaaS run — security, safety and operational risks across conventional ML, context-integrated AI (RAG), agentic and multi-agent systems, each mapped to the OWASP LLM Top 10 (2025) and the NIST AI RMF GenAI Profile.

Conventional ML Context-integrated · RAG Agentic systems Multi-agent architectures
sbdaas://ai-risk-register 7 of 30+ entries · OWASP LLM Top 10 2025 · NIST AI RMF GAI
ID Threat Surface Framework mapping Risk
LLM01
Prompt Injection
Adversarial inputs that override intended instructions or hijack downstream actions. Mitigated with input mediation, isolation, and human confirmation.
 LLM · Agentic OWASP LLM01 · NIST GAI Critical
LLM02
Sensitive Information Disclosure
Leakage of secrets, PII, or proprietary data through model responses. Controlled with DLP, output filtering, and least-privilege retrieval.
 LLM · RAG OWASP LLM02 · ISO 42001 High
LLM04
Data & Model Poisoning
Corruption of training data or knowledge sources to bias or backdoor a model. Countered with signed ingestion and provenance controls.
 ML · RAG OWASP LLM04 · NIST GAI High
LLM05
Improper Output Handling
Unvalidated model output reaching downstream systems, enabling injection or unsafe execution. Enforced with schema validation and encoding.
 LLM · Agentic OWASP LLM05 High
LLM06
Excessive Agency
Over-permissioned tools and autonomy allowing agents to act beyond intent. Bounded by scoped permissions and human-in-the-loop gates.
 Agentic · Multi-agent OWASP LLM06 · NIST GAI Medium
ML-MI
Membership Inference
Inferring whether a record was in the training set, exposing private data. Reduced through regularisation and query-rate governance.
 ML NIST AI RMF · ISO 42001 Medium
ML-EX
Model Extraction
Reconstructing a model or its parameters via systematic querying. Limited with rate-limiting, watermarking, and access governance.
 ML NIST AI RMF Low

The full register carries 30+ entries with actionable mitigations — the knowledge base SBDaaS draws on to rate and control AI risk.

Threat-model your system this week.

Run it yourself in SBDaaS, or engage a JQiT architect to do it with you.

Open sbdaas.jqit.com.au ↗ Book a threat-model session