Home / Replicate / The Thistlewood decision twin: ten questions, one graph, in a vault
A vault
The Thistlewood decision twin: ten questions, one graph, in a vault
Ten questions, one graph, every answer traced to the board, in a vault you can open.
Thistlewood: ten questions, one graph
Phil Venables' ten questions for a CISO's management tool, answered on one graph: the reply, a tour of the vault, and the vault itself to use.
1 · The replyTen questions, one graphWhy his questions are graph questions, and how our risk acceptance work and vaults answer them.
2 · The tourInside the Thistlewood twinThe ten answers one by one: the plot on the graph, the evidence, and the decisions they propose.
you are here
3 · The twinThe Thistlewood decision twinPick a question and watch the graph fade to the answer; read every decision up to the board.Use itOpen the vault ↗His article ↗
Everything in this vault is synthetic. Thistlewood Retail is invented, and so are its people, agents, suppliers, systems, incidents and every number. The ten questions are from Phil Venables, A CISO's Ideal Management Tool (19 October 2026). No model is called: the engine is a small deterministic program, so every answer replays exactly. The reply makes the argument; the tour walks through the answers.
Open it yourself. The key is the whole credential.
Read key:
In the official UI: open it read-only in a new tab · From the CLI:
Published deliberately under the
Read key:
sgit_public_read_32e4f88c6dbc68ae6e2566223008671cc6525ad78ef89482ab4f8b44cb28a07f:6v7kyxf4In the official UI: open it read-only in a new tab · From the CLI:
sgit clone sgit_public_read_32e4f88c6dbc68ae6e2566223008671cc6525ad78ef89482ab4f8b44cb28a07f:6v7kyxf4Published deliberately under the
sgit_public_read_ prefix, and derived one-way from a vault key that is not in this repository. Read back with this key before it was published: the same files, the same app.Open the twin, full screen → or use it here, below
Opens in the vault's own app, read-only, with the published key: the case, the graph, the ten questions, the risk register from the board to the bytes, the decision ledger, and the evidence and back-test.
Use it here
Open the graph and pick a question: everything the answer did not use fades out. Or open the ten questions, one by one, with their evidence and the decisions they propose.
The ten answers, in one line each
| # | Question | What the graph says |
|---|---|---|
| 1 | Where should an extra £250k go? | Spend £250k of £250k; expected annual loss falls from £3502k to £2488k (−£1013k). |
| 2 | Where can £250k be cut with the least impact? | Cut £320k; expected annual loss rises from £3502k to £3532k (+£30k). |
| 3 | The five most exposed business processes, and three things to do for each | Pick, pack and ship (£1645k a year); Take an order and payment (£1043k a year); Release software (£915k a year); Customer sign-in (£663k a year); Marketing email (£350k a year). |
| 4 | The most recurring issues, and why they keep recurring | 38 incidents in twelve months come from 8 recurring causes; the top three are Credential stuffing on customer login (9), Bot surges at checkout (7), Expired TLS certificates (6). |
| 5 | Accepted risks to revisit now | 8 accepted risks are touched by the three events (9 links); their acceptances were made on assumptions that have since changed. |
| 6 | Controls that are now cheaper: deploy them further at the same cost | Hardware keys for staff with production access from 40 of 140 to 133 of 140 (−£352k a year); Passkeys for customers from 1 of 3 to 3 of 3 (−£321k a year), at flat cost. |
| 7 | Minimum viable business processes, and the worst plausible scenario they cannot withstand | The minimum viable processes are take an order and payment, customer sign-in, pick, pack and ship. The most severe plausible scenario they cannot withstand is "Ransomware in the warehouse system": it stops pick, pack and ship, about £2278k at peak. |
| 8 | The ten suppliers whose five-day outage would hurt customers most | The top three: Northwind Cloud (£2848k), CrateWorks (£2848k), PayRail (£1543k). |
| 9 | The humans and agents with the largest blast radius, including their extended graph of privileges | Of 100 identities, the largest blast radius belongs to identity admins and deploy agents, mostly through what they can assume or the secrets they can read. 29 of 40 agents can reach systems beyond what their behaviour policy says they need. |
| 10 | The digital channels whose loss would cost most over the busiest five days | Web store £1260k, Mobile app £853k, Marketplace listings £675k, Phone orders £60k, over the five days from Black Friday to Cyber Monday. |
All figures are in thousands of pounds, from the twin's own engine, on an invented company.
What is in it
| Path | What |
|---|---|
index.html | The app: the case, the graph, the ten questions, board to bytes, the decisions and the evidence; the data and the engine inlined. |
content.json | The graph: roles, channels, suppliers, systems, processes, risks, controls, incidents, events, scenarios and 100 identities with their privileges. |
engine.js | The deterministic engine: ThistlewoodTwin.make(content).ask(n) answers question n and returns the rows, the nodes it used, its evidence and its proposed decisions. |
answers/ | Each answer as the engine produced it. |
decisions/ | 29 proposed decisions, one file each, with holder, door, interval and the chain to the board. |
graph/ | Computed risk totals and the back-test. |
tools/ | The scripts that build all of it. Change the graph, rebuild, and every answer follows. |
A tour
