Notifications
Clear all
Topic starter
July 11, 2026 10:01 am
Seen too many threat models where the scoring system is the biggest threat. High/med/low is lazy, but at least everyone knows it's meaningless. The three-point scales just add more ways to be wrong with confidence.
If you're scoring "probable" without real telemetry or "impact" without a business context, you're just decorating a guess. I'd rather see a clear "assumed in scope" and "assumed out of scope" than a pretty matrix. Show me the failure mode, not the color.
Show me the PoC.