| name | tech-risk-assessment |
| description | Assess the security risk of a technology or product decision for leadership — new technology/vendor adoption, build-vs-buy, third-party/supply-chain, or M&A technical due diligence — and give a clear recommendation with trade-offs. Use to inform a strategic technology decision. |
Goal
A decision-ready security risk assessment of the option(s) under consideration, with
a recommendation that weighs security against velocity, cost, and strategic fit.
Steps
- Frame the decision — what's being decided (adopt X / build vs. buy / acquire Y),
the options, the data/systems involved, and the decision criteria.
- Assess each option's security posture:
- Build — can we build and operate it securely? cost of doing so, our maturity.
- Buy / adopt — vendor security posture, certifications/attestations, data
handling and residency, integration and access scope, lock-in, and exit.
- Third-party / supply-chain risk — dependencies, provenance, and the blast
radius if the vendor/component is compromised.
- M&A due diligence — target's security posture, debt, incident history,
compliance exposure, and integration risk.
- Assess integration & data risk — trust boundaries created, data exposure,
identity/access, and the new attack surface (
threat-modeling).
- Total cost incl. security — build/operate/secure cost over time, not just
license/sticker.
- Recommend — a clear call with the risk trade-offs, required conditions/
mitigations, and residual risk stated honestly.
Output
A tech-risk assessment: decision · options · per-option security posture · third-
party/integration/data risk · total cost incl. security · recommendation + conditions
- residual risk. Use
security-reporting; diagram integration/trust boundaries with
security-diagramming.
Notes
Decide with explicit trade-offs, not security absolutism — the goal is the best
risk-adjusted technology choice for the business. Weight third-party/supply-chain and
exit/lock-in risk; they're routinely underestimated. State residual risk and the
conditions under which the recommendation holds.
