Risk classes

Every mandatory test on a playbook page addresses one of these 12 risks. A risk is attached to a product type only with evidence of the grade set in the methodology.

RiskSeverityWhat it meansProduct types
Money leaves or fails to arrivemoneyDouble charges, lost refunds, wrong amounts, orphan orders, failed payouts.22
Personal or sensitive data exposeddataUnauthorised access to PII or PHI through auth, API or storage faults.42
Fine or enforcement by a regulatorlegalMissing consent, audit trail, retention or reporting required by law or standard.44
Physical or psychological harm to a userharmWrong clinical output, missed crisis path, unsafe device command.13
App rejected or removed by a storedistributionCrashes at review, guideline violations, missing privacy labels, payment rule breaches.27
Outage during a demand peakoutageLaunch, campaign, drop or market event takes the product down.9
Records silently wrongdataMigrations, imports, rounding, timezone and currency errors.15
Fraud or abuse by usersmoneyAccount takeover, fake sellers, bonus abuse, content abuse.21
Third-party dependency failsoutagePayment provider, maps, identity or model provider degrades and the product does not recover.13
Accessibility complaint or lawsuitlegalPublic-facing product unusable with assistive technology.17
Users or operators act on wrong numberstrustDashboards, scores or model outputs are wrong and nobody notices.10
User actions lost on bad networks or devicestrustSubmissions, messages or orders disappear or duplicate.4

Risks by product group

Bars show how many product types in each group carry the risk. The table is the data; the bar is a drawing of the same number.

Money leaves or fails to arrive

GroupTypes carrying itBar
Fintech9 of 10
Healthcare2 of 8
Commerce5 of 8
B2B SaaS1 of 5
Infrastructure and developer products1 of 8
Consumer apps2 of 4
Education2 of 2
Public sector0 of 1

Personal or sensitive data exposed

GroupTypes carrying itBar
Fintech10 of 10
Healthcare7 of 8
Commerce8 of 8
B2B SaaS5 of 5
Infrastructure and developer products7 of 8
Consumer apps3 of 4
Education1 of 2
Public sector1 of 1

Fine or enforcement by a regulator

GroupTypes carrying itBar
Fintech10 of 10
Healthcare8 of 8
Commerce8 of 8
B2B SaaS4 of 5
Infrastructure and developer products8 of 8
Consumer apps4 of 4
Education2 of 2
Public sector0 of 1

Physical or psychological harm to a user

GroupTypes carrying itBar
Fintech0 of 10
Healthcare5 of 8
Commerce0 of 8
B2B SaaS0 of 5
Infrastructure and developer products4 of 8
Consumer apps3 of 4
Education1 of 2
Public sector0 of 1

App rejected or removed by a store

GroupTypes carrying itBar
Fintech5 of 10
Healthcare4 of 8
Commerce6 of 8
B2B SaaS2 of 5
Infrastructure and developer products4 of 8
Consumer apps4 of 4
Education2 of 2
Public sector0 of 1

Outage during a demand peak

GroupTypes carrying itBar
Fintech2 of 10
Healthcare1 of 8
Commerce2 of 8
B2B SaaS0 of 5
Infrastructure and developer products1 of 8
Consumer apps2 of 4
Education0 of 2
Public sector1 of 1

Records silently wrong

GroupTypes carrying itBar
Fintech6 of 10
Healthcare2 of 8
Commerce1 of 8
B2B SaaS3 of 5
Infrastructure and developer products3 of 8
Consumer apps0 of 4
Education0 of 2
Public sector0 of 1

Fraud or abuse by users

GroupTypes carrying itBar
Fintech9 of 10
Healthcare0 of 8
Commerce4 of 8
B2B SaaS2 of 5
Infrastructure and developer products3 of 8
Consumer apps2 of 4
Education0 of 2
Public sector1 of 1

Third-party dependency fails

GroupTypes carrying itBar
Fintech3 of 10
Healthcare2 of 8
Commerce1 of 8
B2B SaaS1 of 5
Infrastructure and developer products5 of 8
Consumer apps1 of 4
Education0 of 2
Public sector0 of 1

Accessibility complaint or lawsuit

GroupTypes carrying itBar
Fintech2 of 10
Healthcare3 of 8
Commerce6 of 8
B2B SaaS3 of 5
Infrastructure and developer products1 of 8
Consumer apps0 of 4
Education1 of 2
Public sector1 of 1

Users or operators act on wrong numbers

GroupTypes carrying itBar
Fintech3 of 10
Healthcare1 of 8
Commerce1 of 8
B2B SaaS1 of 5
Infrastructure and developer products4 of 8
Consumer apps0 of 4
Education0 of 2
Public sector0 of 1

User actions lost on bad networks or devices

GroupTypes carrying itBar
Fintech0 of 10
Healthcare2 of 8
Commerce0 of 8
B2B SaaS0 of 5
Infrastructure and developer products2 of 8
Consumer apps0 of 4
Education0 of 2
Public sector0 of 1

Severity labels

harm
Physical or psychological harm to a user.
money
Money leaves, fails to arrive or is taken by fraud.
legal
A fine, enforcement action or lawsuit.
data
Data is exposed or silently wrong.
outage
The product is down or does not recover.
distribution
A store or platform rejects or removes the product.
trust
Users or operators act on wrong output or lose their actions.