Retail technology company’s AI journey to scalable, developer-led security design reviews

Security reviews limited by human scale

Operating at the scale of thousands of applications and dozens of product verticals, Security reviews were performed manually, a process bound by human capacity and unable to keep pace with the speed of development.

Fragmented view of security risks across applications

The company’s engineering organization runs thousands of applications across product teams, with documentation spread across Confluence, Jira, GitHub, and other systems. This fragmentation made it difficult to connect reviews to the right applications and projects, leading to gaps in visibility and leaving parts of the development process uncovered or only partially reviewed.

Developer initiative outpacing security expertise

The company’s developers are building faster than ever, aided by AI coding tools that accelerate delivery and surface lightweight checks along the way. But while these tools increase speed, they don’t replace the depth of product security expertise needed for thorough design reviews. Developers can’t take on extra manual processes or noisy findings, and they can’t be expected to operate as security specialists. Bridging this gap was essential to making developer-led reviews practical.

Automating design reviews

To overcome the limits of human-scale reviews, the company adopted Clover’s design-led approach to security. With AI, every PRD, diagram, and design artifact across applications and products could be reviewed automatically. The process became consistent, reliable, and free from the variation of human interpretation. Clover never tires and applies the same review standard every time, creating a strong basis for security experts to focus on higher-level analysis while developers can address routine requirements directly.

Unifying security visibility across systems

By integrating Clover with the tools already in use, from documentation to code repositories to Jira, the company created a single source of truth for design reviews. Security requirements and threats could now be tracked end to end, eliminating gaps that previously appeared when reviews were scattered across systems. This gave both security and engineering leaders confidence that critical design changes were consistently covered.

Enabling developer-led reviews with AI guidance

Clover’s AI-native workflows allowed developers to take a more active role in security without requiring deep expertise. Instead of sifting through low-level or noisy results, developers received clear, high-confidence findings contextualized for their design. Automated Slack interactions and in-document annotations made it simple to confirm, reject, or request clarification, while keeping security in the loop for high-severity issues. The result was a model where security could scale by empowering developers, not by adding friction.

Consistency and scale through automation

At the company’s scale, manual security reviews simply couldn’t keep pace. Even with a proactive security team, reviews were bound by human capacity, making it impossible to cover every PRD, ERD, or architecture diagram. By introducing Clover’s design-led automation, security design reviews became a repeatable process that could run across every product surface without fatigue or variation. The result was consistency: every review applied the same criteria, delivered the same quality, and eliminated the risk of human error or oversight.

Automation also opened the door for developers to engage earlier instead of waiting for security bandwidth. High-priority, high-probability threats were routed directly to developers within their workflow, allowing them to resolve issues quickly. The product security team only stepped in when developers needed guidance or deeper expertise, keeping focus on the most critical challenges while still scaling reviews across the organization.

Closing gaps with unified visibility

The company’s engineering environment spans thousands of applications and services, each tied into Jira, GitHub, Confluence, and a service catalog. Before Clover, reviews were fragmented across these systems, creating blind spots and making it difficult to know whether every critical design had been reviewed. Clover closed those gaps by mapping data from all these sources into a single system of record, linking design documents directly to applications and the right review workflows.

With that visibility, the product security team gained confidence knowing that findings were tied back to the specific systems under review. They could trace threats and requirements end to end, from design documents to implementation in code. This alignment ensured no part of the stack was left uncovered and made security reviews an integrated part of engineering rather than a disconnected activity.

Enabling developers to lead on security

The company’s developers have always been eager to build securely, but the reality of modern engineering is that they already juggle a large stack of tools and responsibilities. Adding manual security reviews or noisy findings would only slow them down. Clover changed that by embedding design reviews directly into the tools developers already use, surfacing only high-confidence, high-priority issues.

Through Slack integration, developers can initiate reviews, receive inline comments directly in Confluence, and automatically generate Jira tickets for the findings that matter most. The experience feels intuitive, like having a security co-pilot alongside them in real time. When findings are straightforward, developers handle them independently. When deeper expertise is required, product security steps in. The result is a collaborative model where developers lead day-to-day security decisions, while the security team provides targeted guidance where it matters most.

From design reviews to privacy and compliance reviews

The company’s work with Clover began with scaling design reviews, but the same foundation is opening doors across the wider risk and compliance landscape. Beyond product security, multiple teams have expressed interest in applying Clover’s approach to their own workflows. By building custom frameworks, these groups can translate their policies into clear, enforceable checks inside engineering systems, gaining earlier visibility and stronger alignment with development.