Chained Risk: The Operating Model and Economics of Adversarial Testing

Last quarter, three assessments came back clean. None asked whether the model could be steered to call the function that reaches the low-severity sink; static analysis had already been deprioritized.

That is chained risk: findings of unremarkable severity, spread across an application's layers, composing into a critical impact that none carries alone. Severity gets assigned per finding. The danger is a property of the sequence.

This whitepaper sets out what each adversarial discipline answers, where each one loses visibility, and what it costs to run all three.