Manual reviews don’t scale

With roughly a 30:1 developer-to-product security ratio and only one or two people dedicated to product security, the team couldn’t manually review every design or release. Quarterly, documentation-heavy reviews consumed hours per team and left security without a sustainable way to cover the full scope of product change.

Inconsistent threat modeling across teams

Security reviews relied on each team’s own interpretation of requirements, producing uneven quality and depth. Some groups had strong security expertise while others struggled to apply frameworks consistently, making it hard to maintain a uniform security baseline.

No visibility across design and code stages

Once development progressed beyond design, security had no clear view into code-level changes or code changes without a correlating design artifact such as a PRD or ticket. This created blind spots in understanding how designs were implemented and where unreviewed changes could introduce risk.

Automated reviews embedded in the tools teams already use

Clover integrated directly with Confluence, Jira, Bitbucket, GitHub, and Teams running design reviews automatically within each team’s existing workflow. Reviews happen silently in the background, eliminating the need for manual documentation and allowing security to scale coverage without disrupting developers.

Standardized threat modeling for consistent coverage

Clover automated STRIDE-based threat modeling and mapped findings to OWASP ASVS, ensuring every team applied the same framework regardless of individual experience. Security requirements are now generated automatically per feature, providing consistent, high-quality coverage across all products.

Correlating design and code for real-time visibility

By connecting design artifacts with code repositories, Clover surfaces untracked code changes and design-to-code drift. Security can now see where development activity is happening without a corresponding design review, enabling proactive outreach and faster risk detection.

Scaling security to match pace with engineering

At PROS, the security architecture team wanted to bring security in step with the speed and innovation of engineering. With a roughly 30:1 developer-to-security ratio and only a small number of people focused on product security, quarterly manual reviews could no longer keep up with continuous releases. Each review required hours of documentation and coordination, and only a limited number of design changes could be covered. The team set out to find a way to scale reviews, maintain depth, and keep engineers focused on delivery.

With Clover, reviews now run automatically in the tools engineers already use. Designs created or updated in Confluence and Jira are analyzed in real time, removing the need for manual documentation and repetitive review steps. Security feedback appears directly in context, allowing teams to address issues immediately. This change has expanded review coverage by more than 400 percent without adding headcount, enabling security to keep pace with development while maintaining the same level of depth and consistency across products.

Delivering exceptional threat modeling, every time

At PROS, security and engineering teams were already performing strong, detailed design reviews, but there was still natural variation in how threats were identified and prioritized. Even the most experienced engineers approached reviews differently depending on the product, the timing, or the specific context of a release. The security architecture team wanted to eliminate that variability and bring a new level of precision to its process, standardizing how threats were analyzed and ensuring exceptional quality every time, regardless of who performed the review.

With Clover, PROS brought consistency, objectivity, and depth to its design reviews. The platform automates STRIDE-based threat modeling, applies OWASP ASVS standards, and generates security requirements per feature automatically. Each review now follows the same rigorous framework, ensuring that every product meets the same high bar. This shift removed the variability inherent to manual analysis and raised the overall quality of threat modeling, giving security and engineering shared confidence that every design is reviewed with the same precision and completeness.

Pulling back the curtain: visibility from design to code

Before Clover, once development moved beyond the design stage, security had little visibility into how designs translated into code. Changes sometimes occurred without a matching design artifact such as a PRD or Jira ticket, leaving potential blind spots in understanding how risks were being addressed. The team wanted to connect design and implementation in a single view to understand what was changing, where, and why, and to identify unreviewed work before it could introduce risk.

Clover connected PROS’s design documentation and ticketing systems with its code repositories, correlating every design element to its implementation. The platform automatically surfaces untracked commits, design-to-code drift, and development activity happening outside approved designs. This gave security the context it had been missing, transforming design reviews from point-in-time checks into a continuous view of product risk. With this new visibility, security can proactively identify where guidance or intervention is needed, closing the gap between design intent and implementation.

Securing the next frontier of AI-native development

As PROS continues to expand its use of AI in software delivery, the focus is shifting toward understanding how to secure AI-generated code and the growing ecosystem of internal agents and third-party tools. The organization is exploring ways to prevent policy drift as prompts and models begin to make implementation decisions, and to bring greater visibility into where and how AI is being used across products. Together with Clover, PROS is shaping what secure AI-native development looks like, balancing speed and innovation with the guardrails needed to keep every line of AI-assisted code aligned with organizational standards.