Prioritizing Improvements

Overview

Risk-based prioritization is objective, not negotiable. Security vulnerabilities are critical regardless of stakeholder opinion.

Core principle: Critical security = Phase 1, always. Stakeholder preferences don't change technical risk.

When to Use

Use this skill when:

• Creating improvement roadmap from technical debt catalog
• Stakeholders disagree with your technical prioritization
• CEO says "security is fine, we've never been breached"
• CTO wants foundational work before security fixes
• VP wants feature delivery instead of security work
• You're tempted to "bundle" work to satisfy multiple stakeholders
• Time pressure (Friday deadline) influences prioritization decision