Proposed
Diversity requirements on critical paths
Auth, crypto, and payments are not written by a single model family without a second implementation.
No compiled flow or public database names this control yet.
Who should own it
CISOs
Enterprises
How quickly it can land
Weeks
A dedicated squad can land it inside two months.
Expedited implementation
4 weeks
30 calendar days with a crash team
Normal implementation
4 months
120 calendar days as a planned program
Risk this mitigates
15Given that AI coding tools are already in the provenance of public CVEs, and they are being adopted as the default author of new code, there is a possibility of a correlated class of bugs shipping across many products at once resulting in a software ecosystem whose defects an attacker can study once and exploit many times.
Residual composite 15 · still above the threshold
Effect if implemented
Applied to every failure scenario on that risk, then re-ranked. Axes are clamped at 1.
- Likelihood
- −1
- Consequence
- −1
- Urgency
- −0