Security assessment at the system design and architecture level, analyzing network segmentation, trust boundaries, authentication and authorization flows, session management, privilege separation, failure resilience, and architectural-type attacks. Precedes or complements application penetration testing by identifying structural weaknesses that can compromise the entire ecosystem even if individual components are secure.