=

The passage around this formula

Finding the failure is only half the design problem. The other half is scoring it, and a plain pass/fail count throws away exactly the information a consequence-aware evaluation needs — it treats a wrong word choice and a deleted database as the same unit. A more defensible score weights each discovered failure mode by its consequence rather than counting it once: $R = \sum_{i} \Pr(\text{failure mode } i) \cdot B_i$. where $B_i$ is the blast radius assigned to failure mode i : how much of a system, how much data, how many users or how much liability a given failure could plausibly reach, drawn from a small number of severity tiers rather than treated as a continuous unknown. This is not a hypothetical scoring scheme; tiered,…

Read this part in the article →