A mobile operator's risk matrix rates seventy percent of modeled threats amber — what do you change?

## Read the distribution, not the ratings Any individual rating on a heat map can be defensible while the map as a whole is useless. The matrix exists to answer one question — what do we work on first — and a picture in which seventy percent of modelled threats share one colour answers it with a shrug. The first move is therefore not to adjust a rating but to state the decision the artefact is supposed to drive, and to say plainly that it currently does not. ## Diagnose before adjusting Four causes produce a clumped map, and they need different responses. **Central tendency.** When bands are defined by adjectives, the middle is the least criticisable choice. A rater who picks Moderate on both axes is never obviously wrong. This is a property of the raters and the wording, not of the system, and no amount of recolouring touches it. **Genuine sameness.** For a mobile-network operator, a large share of modelled threats really do fall in the same neighbourhood: various ways of degrading availability for a lot of subscribers, none catastrophic on its own, none negligible. The portfolio is truly bunched, and the bands are cut at the wrong places to separate it. **Bands cut on absolutes.** Corporate scales are often written so that the top bands describe outcomes this particular product cannot produce and the bottom bands describe outcomes nobody bothers modelling. Everything real lands in the middle two rows by construction. **Colouring.** The severity regions painted over the grid are a separate decision from the bands themselves, and drawing amber across a dozen cells guarantees a dominant colour whatever the underlying ratings say. ## What actually restores discrimination - **Re-cut the bands against the portfolio you have.** A scale should split the population you rate. If your threats cluster between two boundaries, the useful move is to place boundaries *inside* that cluster — subdivide the region where your decisions actually live — rather than to keep a scale calibrated for harms your service cannot cause. - **Fix the extremes too.** The mirror failure is range compression: a 5x5 whose top impact band covers both a delayed service and a loss of life. Two outcomes demanding entirely different responses share one cell, and the grid can never tell them apart. Split the band, or lift safety-of-life out of the grid as a separate gate rather than as a matrix row. - **Declare a tiebreak in advance.** Within a band, order by criteria agreed before the ratings exist: cost and structural quality of the fix, blast radius, whether exploitation would be detectable, whether one fix closes several modelled threats at once. Declaring them in advance is what stops the tiebreak becoming advocacy. - **Cap the population if you must.** Some teams impose a discipline that no more than a fixed number of threats may hold the top two colours at once; adding one forces demoting another. Crude, and it does force the conversation the matrix was avoiding. ## Know when the grid is the wrong instrument A matrix converts judgment into a shared picture. When the population is genuinely homogeneous, that picture carries almost no information, and the honest answer may be to abandon the grid for this portfolio. A **forced ranked list** — comparing threats pairwise until you have a total order, then drawing the line where capacity runs out — produces a decision the heat map could not, and it makes the tradeoffs explicit rather than hiding them behind a colour. The cost is that a ranked list does not aggregate or communicate upward as neatly, which is precisely why matrices persist. ## The traps to avoid Recolouring until the picture looks balanced is the most common wrong answer: it changes the presentation and none of the underlying judgments, and it teaches everyone that the colours are negotiable. Adding bands — moving to 7x7 — is the second: more cells on unanchored axes give false precision and more argument. Insisting that every amber item must be fixed is the third; it reads as rigour and is really a refusal to prioritise, which is the same failure the clumped map already represents. ## What an interviewer is listening for This question separates people who maintain a process from people who own a decision. The strong answer treats the clustering as evidence about the instrument, distinguishes causes that live in the raters from causes that live in the system, proposes a fix targeted at the diagnosed cause, and is willing to say that the artefact should change or be dropped. The weak answer adjusts colours until the heat map looks like the ones in the slide deck.