1. Threat Modelling intermediate

    A commerce platform threat-models its checkout flow. Which threats are usually missed, and what makes a threat model useful rather than ceremonial?

    2 min answer threat-modellingcheckoutabusestride
  2. Threat Modelling intermediate

    A design review shows a threat model with one trust boundary — internet to application. What boundaries are missing?

    2 min answer threat-modellingboundariesreview
  3. Threat Modelling intermediate

    An insurance platform runs a threat modelling exercise that produces a long list nobody acts on. What went wrong, and what makes threat modelling useful?

    2 min answer ackothreat-modellingprioritisationdesign
  4. Threat Modelling intermediate

    Threat modelling is widely recommended and rarely practised sustainably. What makes it fail, and what does a version that survives contact with delivery look like?

    2 min answer threat-modellingstridesecurity-reviewprocess
  5. Three Lines Model intermediate

    An organisation adopts the three-lines model and it produces friction without assurance. What went wrong?

    2 min answer ripplingthree-linesgovernanceaccountability
  6. Three Lines Model intermediate

    How does the three lines model apply to a technology organisation, and where does it go wrong?

    2 min answer three-linesassuranceownershipindependence
  7. Three Lines Model intermediate

    How does the three-lines model apply to a modern engineering organisation, and what goes wrong when the second line is staffed by people who cannot read the systems?

    2 min answer governanceriskassuranceengineering
  8. Three Lines Model intermediate

    To stop the risk function writing policies nobody can implement, a company embeds two risk engineers inside the platform team to build and operate the policy gate themselves. Time from policy publication to enforcement drops from two quarters to days. What has the company given up, and when does that bill arrive?

    3 min answer three-lines-modelindependencepolicy-as-codecodeowners
  9. Throughput intermediate

    A pipeline moves from writing records one at a time to batches of 500, and throughput rises roughly twentyfold. What has been given up, and at what batch size does the trade stop paying?

    2 min answer batchingthroughputlatencyblast radius
  10. Throughput intermediate

    Throughput has plateaued and adding instances does not help. What are the candidate bottlenecks and how do you identify which?

    2 min answer throughputbottlenecksaturationscaling
  11. Time to Market intermediate

    A platform must ship a major capability quickly. Which architectural shortcuts are acceptable, and which create debt that compounds?

    2 min answer time-to-markettechnical-debtreversibilityshortcuts
  12. Time to Market intermediate

    A retail business needs a new category live before a seasonal peak. Engineering says the correct architecture takes two quarters. How should the trade-off be made?

    2 min answer nykaatime-to-markettechnical-debtreversibility