A security team stops scoring findings on a five-by-five likelihood-impact matrix and instead writes each one as a reachable attack path with the single change that closes it. Remediation throughput triples in a quarter. What has the organisation given up, and when does that bill arrive?

What is gained

An attack path is falsifiable and a score is not. "Likelihood 4 impact 5" invites an engineer to argue the number; "an unauthenticated request to this endpoint reaches the export job which writes to a bucket any employee can read" invites them to break the chain. Naming the one change that removes the path converts a finding into a ticket with an estimate, which is why throughput moves. Teams commonly go from a third of high-severity findings closed in a quarter to most of them.

What is paid

• Comparability across the portfolio. With scores, 40 teams' findings sit in one sortable register. With narratives, nothing sorts. The security lead loses the ability to answer "where is our worst exposure" without reading everything.
• Aggregation upward. A board or risk committee trends a number. Narratives do not aggregate, so the quarterly slide quietly becomes a count of open findings, which is a worse metric because it rewards not opening them.
• Author time. A matrix row takes about 10 minutes. A traced path with a reachability argument and a costed fix takes 45 to 90 minutes. Three reviewers who produced 200 findings a quarter now produce perhaps 60, so coverage falls even as closure rises.
• The audit artefact. Control frameworks and insurance questionnaires expect a risk register with ratings and documented acceptance. A folder of narratives satisfies an engineer and not an auditor.

When the cost becomes visible

Not in the first quarter, when closure rates look excellent. It arrives at the annual audit or insurance renewal, when someone asks for the register and the accepted-risk list with ratings. It arrives again when a second business unit must be compared with the first, and again when the security lead changes and the new one has no way to triage an inherited backlog of prose.

How to keep both

Make the narrative the body of the finding and derive a severity label from the path rather than voting on it: reachable without credentials, reachable with any employee credential, reachable only with administrative access, plus the data class at the end of the path. That yields a sortable field that cannot be negotiated independently of the mechanism. Never let the derived label decide the work — the work comes from the path and the cost of closing it. And keep a one-line acceptance record with an expiry date for every path a team chooses to live with, because that is the only part the auditor actually needs.

When this is the wrong answer

When coverage matters more than depth. A first pass over 300 services that nobody has ever looked at is better served by cheap scored triage, because the goal is finding the unknown rather than closing the known. Switch to paths for the top tier once the map exists. Below roughly 20 findings a quarter, skip both and put each one in front of the owning engineer in person.