Build vs Buy — AI-era Security Decision Matrix

00Candidate

What control, product or project are you evaluating?

Is the risk or delay you are fixing material today?

Frightening demos are not exposure. If it is not material, the framework is allowed to stop here.

Yes No

Does an existing control mostly cover it?

Yes No

Is it a narrow workflow you can own and maintain?

Yes No

Will it deliver a measurable reduction in exposure or latency?

If you cannot say how you will measure the improvement, the buying conversation is premature.

Yes No

Threat relevance

Does it address a threat path attackers actually use against your exposure?

Latency / exposure reduction

Which of know → decide → act → verify → recover does it actually shorten?

Authority & blast radius

What can it execute, which identities does it inherit, how fast can you revoke it?

Auditability & operational burden

Can actions be reconstructed? Who operates it at 2 AM?

Dependency & exit cost

What happens when the provider changes pricing, model or behaviour?

Notes — bottleneck, owners, expected evidence