ACCORD

tl;dr A security tool that clients can’t run reliably won’t deliver its promised protection, no matter who recommends it.

In security we keep optimizing for completely solving the problem, when the bigger constraint is whether anyone can actually adopt the thing. Most security tools genuinely solve the problem they target but come at costs to install, configure, and live with that are unacceptable.

I picked up ACCORD, a framework for technology adoption, from Jonathan Levav at Stanford in summer 2025. The version I learned has six criteria:

• Advantage: Is it better than what people use now?
• Compatibility: Does it fit their existing habits, values, and tools?
• Complexity: How hard is it to understand and use?
• Observability: Can others see it being used and recognize its benefits?
• Risk: What could people lose if it fails?
• Divisibility: Can people try it on a small scale before committing?

I run startup pitches, internal research, academic proposals, and client recommendations through it.

A founder pitched me a tool for tracking data flows through AI systems to protect against prompt injection. It would label tainted data so user data and prompts could be kept separate from the rest of the system. But it required extensive manual implementation and tagging. The system was brittle, and adoption was all or nothing.

They wanted to partner with Trail of Bits for the credibility and trust we’d earned with clients. We’d introduce the product and provide services to install and configure it.

I declined because we’d end up asking clients to adopt a tool they couldn’t manage. It was too complex to operate, would break in production, and wouldn’t deliver the security benefits they wanted. Our introductions and installation services wouldn’t solve those problems or change the ACCORD assessment.