Insecure design is a weakness built into the architecture of a system, not just a mistake in a line of code. It happens when security requirements are missing, weak, or added too late, so the software is built with unsafe assumptions about users, data, trust boundaries, or failure handling. Common examples include missing authorization checks, unsafe default settings, weak session flows, or business logic that can be abused even when the code is syntactically correct.
This matters because attackers often prefer design flaws: they are reliable, hard to patch quickly, and can affect every feature built on top of the bad pattern. In real attacks, insecure design can enable privilege abuse, data exposure, or workflow bypass without needing a traditional exploit. Defenders reduce the risk by setting security requirements early, modeling threats, reviewing architecture, and testing abuse cases before release. Secure defaults, strong access control, and secure software development practices help prevent the weakness from being repeated across a codebase.