Security Architecture Review

Vulnerability scans find weaknesses in deployed code. Penetration testing finds exploitable issues in running systems. Security architecture review finds problems in the design. Before deployment, in the structure of the system itself. A flaw in architecture (authentication that's bypassable by design, data flows that route sensitive information through unprotected intermediaries, trust relationships built on assumptions) often can't be fixed by a patch. It requires redesign.