You may discover that your security model (row 2) assumes a “zero-trust network,” but your Physical reality (row 4) still has a shared switch in a broom closet. Or that your Motivation column (Why?) is full of heroic declarations (“to protect patient lives”), but your Operational row (Who?) has no names—just the phrase “To be determined.”
Descend to : How is the system structured? (Encryption key management system, access control lists). sabsa architecture matrix
: Who wakes up at 3 AM when the key rotation fails? (The L3 engineer in Bangalore). You may discover that your security model (row
: Which specific products? (Model X crypto-card, firmware v2.1). : Who wakes up at 3 AM when the key rotation fails
Using the SABSA Matrix feels less like engineering and more like cartography. You are mapping an unknown territory—the territory where business goals, human behavior, physics, and time all collide. And on a good day, when all 36 cells are filled and aligned, you don’t just have security architecture. You have a prophecy of resilience.