--- title: "Interview with Udaya Bhaskar Vemuri, Senior Application Security Analyst" description: "Vemuri discusses approved AI models, evidence-based findings, architecture context and collaboration with application teams." canonical: "https://news.featured.com/ai-speeds-secure-design-reviews-humans-decide-says-appsec" published: "2026-11-03T19:18:26.438Z" updated: "2026-11-03T19:18:49.437Z" format: "interviews" beat: "Technology & AI" tags: ["AI", "Cybersecurity & privacy", "Software & SaaS", "Application security", "AI adoption", "DevSecOps"] author: "Udaya Bhaskar Vemuri" editor: "Haley Spracale" license: "Featured News Republication License 1.0" --- # Interview with Udaya Bhaskar Vemuri, Senior Application Security Analyst _Vemuri discusses approved AI models, evidence-based findings, architecture context and collaboration with application teams._ Interviews · [Technology & AI](https://news.featured.com/beat/technology-ai.md) · Edited by Haley Spracale · 2026-11-03 Interview with Udaya Bhaskar Vemuri, Senior Application Security Analyst ## As a Senior Application Security Analyst, how would you describe your work in application security and the perspective you bring to secure design reviews? As an application security engineer/architect, my goal is always to build secure application designs and work toward a shift-left design model. Secure design reviews (SDR) help in designing secure architectures and identifying flaws early in the software development life cycle (SDLC) process. Designs should also be scalable to support future-oriented AI designs and other capabilities. ## What path led you to become a Senior Application Security Analyst, and how did secure design reviews become an important part of your work? I started my career in security, and I came to love the work I did. Secure design reviews became especially interesting to me because they are the foundation of any application design. If an application's architecture or design is secure, the application tends to withstand attacks better than it would by relying only on front-end protections such as network firewalls and web application firewalls. ## When you first began using an LLM-based assistant in design-review preparation, what practical problem were you trying to solve? It’s been more than a year now. I was trying to solve the problem of keeping application security in step with the speed at which applications need to grow and scale their features to meet customer needs, so that security would never become a bottleneck for development teams. This is where AI-based reviews with human intervention help speed up reviews, prevent security from becoming a bottleneck, and ultimately deliver a secure application. ## How do you decide which application materials and review tasks are appropriate to share with an AI assistant, particularly when handling sensitive technical information? The AI model should have gone through its due diligence with the technology risk assessment teams and been approved by the compliance and security teams before you start sharing details with it. Nowadays, many major vendors offer on-premises options on an isolated network for your company, where they don't use your data to train the AI model. Once you have an approved AI model, you can share architecture diagrams and other details to conduct a secure design review. ## What structured context do you provide an AI assistant to get useful early insights into an application’s architecture, data flows, and likely threat areas? So, once the application teams share the architecture diagrams, data flow diagrams, and C1, C2, and C3 diagrams, we can run them through the AI and ask it to provide evidence-based results and explain, for each vulnerability, why it considers the application vulnerable, what part of the design triggered the vulnerability, and why it assigned that severity. This way, you will get an evidence-based result from the AI, and then you can manually question each finding. ## Can you describe how you validate AI-generated review questions or observations before they influence a security finding or risk decision? The configuration I set, or the prompt I give the AI, is to do SDR reviews using industry standards for findings and risk determination. Then, I send a list of questions to my internal app team to find out what kind of data the app handles and whether it is internally or externally facing. These are some generic questions that help the AI determine the risk. At the end of this process, there will be human validation. ## Where have you found AI assistance most valuable in helping uncover gaps around authentication, authorization, integrations, or data handling during a design review? I have found AI most valuable when reviewing complex designs and comparing them with previous design releases, as it can relate the overall architecture, data flow, and API or other integrations. It helps uncover issues related to authorization, authentication, integrations, and data handling if you provide the right prompt, ask the right questions, and give the AI the exact details it needs to evaluate the design. ## How do you keep AI-assisted reviews collaborative with engineering teams rather than allowing the tool’s output to become a substitute for technical discussion and evidence? I treat AI as a supporting tool for speeding up reviews rather than as a final decision-maker. A human always makes the final decisions. We go back and forth with questions to application teams to address assumptions AI makes when highlighting a finding. In this way, neither AI nor I make assumptions; instead, we deliver findings based on evidence. This also helps us understand the actual risk. ## For application security teams starting with AI-assisted secure design reviews, what is the first human-led process or guardrail you would put in place, and why? As I’ve said throughout., evidence-based output and human validation are the first and last guardrails I would put in place. AI might not understand the complete architecture. For example, it might flag a GDPR issue, but the compliance team may have already addressed it. Rather than sending the finding, first check with the app teams to see whether they have that data or those rules in place. This helps ensure a better secure design review using AI. ## Thanks for sharing your knowledge and expertise. Is there anything else you'd like to add? Yes, AI is developing at a fast pace, and application development is too. We can integrate with TFS or Git, read the full code, and ask the AI itself to give you the C1, C2, and C3 diagrams. Then you can send the diagrams to the app team to validate. In this way, the app team's burden is reduced, and they will be happy to collaborate. Happy exploring AI. ## About the expert **[Udaya Bhaskar Vemuri](https://connectively.us/p/udaya-bhaskar-vemuri)** Senior Application Security Analyst --- Read the full story at https://news.featured.com/ai-speeds-secure-design-reviews-humans-decide-says-appsec Free to read, quote and cite with a link. Republishing is licensed only to approved Featured News publishers through the publisher hub (apply: https://news.featured.com/publishers). [Featured News Republication License 1.0](https://news.featured.com/publishers#license)