For Riskified's Account Takeover Protection, should we focus on enhancing real-time detection capabilities or improving post-attack analysis and reporting features?

Introduction

For Riskified's Account Takeover Protection, we're facing a critical trade-off between enhancing real-time detection capabilities and improving post-attack analysis and reporting features. This decision will significantly impact our ability to prevent fraud and provide value to our clients. I'll analyze this trade-off by examining the product context, identifying key metrics, designing experiments, and providing a data-driven recommendation.

Step 1

Clarifying Questions (3 minutes)

• Based on recent market trends, I'm thinking account takeover (ATO) attacks are becoming more sophisticated. Could you share any data on the evolving nature of ATO attacks our clients are facing?

Why it matters: Helps prioritize features based on current threat landscape Expected answer: Increase in bot-driven attacks and social engineering Impact on approach: Would influence the balance between real-time and post-attack features

• Considering our revenue model, I assume we charge based on transaction volume protected. Is this correct, and are there any performance-based components to our pricing?

Why it matters: Aligns solution with business incentives Expected answer: Mix of volume-based pricing with performance bonuses Impact on approach: Would emphasize features that directly impact detection accuracy

• Looking at user impact, I'm curious about the primary pain points our clients experience with the current ATO protection. What feedback have we received from our top clients?

Why it matters: Ensures solution addresses key client needs Expected answer: Mix of real-time prevention and post-attack insights requests Impact on approach: Would help balance resource allocation between the two areas

• From a technical perspective, I'm wondering about our current system's scalability for real-time detection. What's our current latency for real-time decisions, and how much room do we have to add complexity?

Why it matters: Determines feasibility of enhancing real-time capabilities Expected answer: Current latency under 100ms, with some room for added complexity Impact on approach: Would influence the extent of real-time enhancements possible

• Regarding resources, what's our current team composition in terms of real-time detection vs. data analysis expertise?

Why it matters: Helps understand our capacity to execute in each area Expected answer: Slightly more real-time detection experts Impact on approach: Would impact the feasibility and timeline for each option