"Secure by design" is a principle that may sound obvious in hindsight: build security into systems from the beginning rather than trying to add it later. Yet software development has traditionally treated security as something to be tested for after the fact: find the vulnerabilities, then fix them.
The concept has roots in formal security frameworks. CISA's Secure by Design initiative promotes the principle that technology manufacturers should build security into their products from the start, rather than treating it as an add-on feature.
The problem with the test-and-fix approach is that it's expensive and incomplete. Vulnerabilities found late in development are costly to remediate. Architectural security issues may be impossible to fix without starting over. And no amount of testing catches everything.
Security as a Default
Secure by design flips the model. Instead of asking "Is this secure?" after code is written, you design systems that are secure by default. Authentication is required unless explicitly disabled. Input is validated unless explicitly trusted. Data is encrypted unless there's a specific reason not to.
When secure choices are the defaults, you only need to audit the exceptions, places where someone deliberately chose a less secure option. This dramatically reduces the attack surface that needs review.
The AI Coding Challenge
AI coding agents complicate secure by design because they generate code based on patterns learned from training data, which includes plenty of insecure examples. An AI might default to string concatenation for SQL queries (an insecure pattern) rather than parameterized queries (a secure pattern) simply because it's seen more of the former.
ACSM addresses this by providing security context during generation. The AI doesn't have to guess what "secure" means for your environment. It receives explicit guidance about security requirements and patterns. The goal is making the AI's default output secure, so exceptions require deliberate effort rather than secure code requiring extra care.
Corridor implements this by injecting security context into the AI's workflow through MCP, and verifying output through hooks. The result is AI-generated code that follows secure-by-design principles by default.