A VAST rollout produced a model per system but expert review capacity did not grow - what now?

## The situation A federal agency is required to hold a current threat model for every system in its inventory. A VAST-style rollout delivers exactly that: delivery teams author process-flow application models at scale, the inventory fills in, and the mandate is technically satisfied. Meanwhile the security function has the same number of people it had before. This is the standard second act of any successful scale-first modeling programme, and it is a genuinely open judgment call, which is why it is asked at principal level. ## The mistake to name first The programme has demonstrated **production capacity**, and production capacity is not assurance. A model whose threats no one examined tells you the team drew a diagram. It does not tell you the threats are enumerated, that the important ones were found, or that any of them will be fixed. If you allow the mandate's language — *modelled* — to be read as *assessed*, you have built an artefact that makes the organisation feel covered while changing nothing, and you personally will be the one who signed off on that impression. ## Four moves that actually help **1. Triage instead of queueing.** Trying to review everything at a uniform depth guarantees uniform shallowness and a growing backlog. Rank by two axes the models themselves give you: exposure (does anything unauthenticated reach it) and the asset behind it (money, citizen personal data, credentials, audit truth). Read the top slice properly, sample the middle randomly so nobody can predict which models get looked at, and consciously accept the tail. **2. Raise the floor of the models themselves.** If judgment is the scarce resource, spend some of it once on what a self-authored model is required to state rather than repeatedly on reading finished ones. A required minimum — every entry point, what data the system holds, who can reach it without authenticating, which shared services it depends on — costs the authoring team little and makes an *unread* model useful, because triage can be done from its facts. Weak models usually fail by omitting structure, not by mis-analysing it. **3. Judge the programme by delivery outcomes, not document counts.** The signal that a model was more than paperwork is that something downstream changed: threats carry named owners, mitigations appear and close in the team's own backlog, a design was altered before it shipped. If nothing downstream ever changes, the models are compliance artefacts regardless of how many exist. **4. Be explicit with the mandate owner about the depth ceiling.** Say what a self-authored model is: a structured statement by the builders of what the system is and what they believe can go wrong with it. That is a real and useful floor, especially across an estate nobody previously had a map of. It is not an assessment. Making that distinction in writing is what converts "we are at 100 percent" into a serious argument for funding depth where it matters — and it protects you when an incident lands on a system with a green model. ## The counter-argument, which you should engage rather than dismiss Someone will argue that unreviewed models are worthless and the programme should be cut back to twenty deep assessments. Take it seriously and then answer it. Breadth has two independent values that depth cannot supply: the teams that authored the models thought about their own threats, which sometimes changes a design without any security involvement at all; and the portfolio becomes queryable, which is how you found out which systems deserve depth in the first place. Cutting to twenty deep models restores the old problem — the other systems become unknown again, and unknown is where the surprises are. The right answer is almost never all-breadth or all-depth; it is breadth as a floor with a deliberately funded, deliberately small deep tier. ## What weak answers look like Promising to hire enough reviewers to read everything, which is the same arithmetic failure that motivated scale-first modeling in the first place. Declaring victory on coverage. Or the opposite: rubbishing the whole programme without acknowledging that a mapped estate is worth something. An interviewer at this level is listening for whether you can hold both facts at once — that the coverage is real, and that it is not what the word implies — and whether you will say the second part to the person who owns the mandate.