‘Good, fast, cheap... Pick two’: Software quality dilemma forces risky decisions

This article analyzes how the software development "iron triangle" (good, fast, cheap) shapes security outcomes in commercial software, highlighting vendor opacity and the need for organizations to continuously validate third‑party risk using contextual, risk-based testing such as SBOMs and binary analysis. It urges embedding these results into vendor management to drive accountability and applying mitigating controls when vendors cannot or will not remediate.