Microsoft Secure Design Studio SDS – First Look & Full Demo!

Summary

Andy Malone and Microsoft Senior Security Architect Frank Simorjay introduce and demonstrate Microsoft Secure Design Studio (SDS), a free, open-source tool for threat modelling and secure application design. It helps developers and IT teams understand what AI-generated or manually designed software contains, and identify security and privacy concerns before deployment.

How the Demo Works

• Describe a system in ordinary language: SDS uses an AI model to generate an initial architecture diagram from a prompt, such as a secure document-hosting website. The demo connects to OpenAI Foundry. Frank says Claude and ChatGPT Codex are also supported through their command-line interfaces.
• Inspect architecture and data flows: The diagram shows components, connections, authentication details, and data types. Built-in examples, including a payment-processing flow, help users get started.
• Analyze threats and privacy: The design assistant identifies potential risks, such as a flow with missing authentication instructions, and offers recommendations. Data classification helps users consider privacy as well as security.
• Explore simulated attacks: The tool can model a potential breach, outline its stages and goals, and point to components or connections that may need further investigation.
• Review sequences and track fixes: A sequence view shows interactions and returns across the system. Teams using Azure DevOps (ADO) can turn findings into work items for remediation.
• Work with existing threat models: SDS can import files from Microsoft’s older TM7 threat-modelling format.

Getting Started and Limitations

SDS is open source and available through its repository at aka.ms/SecureDesignStudio. Users need to clone and configure it by following the setup instructions; the interview notes that some technical familiarity may help.

Frank says the tool is designed to be extensible and invites community contributions, including libraries for non-Microsoft platforms such as AWS and Google. The interface shown is Microsoft-oriented, and the video says Mac and Linux support is planned.

SDS is presented as a way to speed up architectural review and surface issues—not as a substitute for validating the design or fixing risks. The video also includes a brief sponsorship message for MyWorkDrive, a secure file-access gateway.

Main Speakers

• Andy Malone — Host and presenter
• Frank Simorjay — Microsoft security architect and SDS demonstrator