VRSD: Vector, Reachability, Severity, Detectability. 4 dimensions, the combination tells you the one Actor to fix before you ship next.
The foundational shift
An Actor is a person playing a role the product never wrote for them, in a scene the product ignored. Actors are not anomalies, they are evidence that the product's definition of "the user" is insufficient. Anti-ICPs were not even considered.
The methodology refuses vague language and every Actor is specific. Not just "vulnerable users." Not just "bad actors." A specific person in a specific scene with a specific motive or vulnerability the product wasn't designed for.
"Vulnerable users might be at risk."
"The Returning Spouse - a divorced parent regaining access to a shared calendar account, with visibility to where their ex now goes on Tuesdays."
"Bad actors could misuse this."
"The Inference Squatter - a developer who realizes your free chatbot has unrestricted GPT-5 access and starts using it for unrelated coding work."
When you name an Actor specifically, you can score them. When you can score them, you can prioritize which to take out first. When you can prioritize, you can ship.
The 4 dimensions
Each dimension forces a call. Never "medium" or "depends." The methodology's value comes from forcing the alternatives that turn soft worry into shippable decisions.
How harm travels : The pathway from product behavior to the Actor's experience.
DIRECT: the product harms the Actor directly.
INTERMEDIATE: harm travels through a trusted person (teacher, parent, employer, partner).
SYSTEMIC: harm moves through infrastructure such as data pipelines, algorithms, aggregated effects.
Probability of encountering the harm.
HIGH: encountered by default through normal use.
LOW: requires deliberate access or unlikely conditions.
Magnitude of harm, for this specific Actor (not the "average user").
HIGH: irreversible, life-altering, requires external intervention to recover.
LOW: recoverable inconvenience, no lasting impact on autonomy or dignity.
Will anyone notice, engage?
HIGH: flagged by analytics, generates support tickets, recognized by the Actor.
LOW: invisible to the company, the Actor, and possibly regulators.
When contested between HIGH and LOW, lean towards HIGH. Invisible harm and unidentified Actors compound, and the cost of over-flagging is a conversation worth having. The cost of under-flagging though is a shipped exploit.
The prioritization
Plot every Actor on this 2x2, Reachability x Severity scale. The one in the top-right quadrant, HIGH Reach AND HIGH Severity, that's your blind spot. That's the one you need to prioritize ASAP.
The Blind Spot is the ship-blocker quadrant. When you name an Actor who scores HIGH on both Reach and Severity, that Actor needs to block your roadmap until addressed. It's not because shipping is impossible, but because shipping without addressing them ships the harm with the feature, which at a later time you'll end up scrambling to fix, and may get you in legal trouble.
Required Actors
An investigation that doesn't name a Bridge User and an Adversarial Actor is incomplete. An investigation of a product touching a vulnerable population that doesn't name the specific vulnerability Actor is akin to 'turning a blind eye' and the VRSD Methodology refuses partial coverage.
Is someone who experiences the product through someone else's use, who never opted in. This is the most-missed category - the recipient of automated outreach, the face in a generated image, the voice cloned without consent.
Is someone deliberately misusing your product - the cheater, the scammer, the prompt-injection prober, the social engineer. They are no longer considered edge cases, they are guaranteed users of any sufficiently useful tool.
When your product touches any of these populations, the corresponding Actor types stack on top of the base requirements:
Predator pattern Actor + Exploitation-by-peers Actor. Required for any product where minors plausibly access, including via a parent's or family account.
Scam-targeting Actor + Isolation-exploitation Actor. Required for any product targeting retirement, healthcare, eldercare, or with 65+ user base.
Crisis-specific exploitation Actor. Focused on mental health, addiction, recovery, abuse survivors, financial distress, bereaved, terminally ill.
Regulatory-violation Actor. Triggered by HIPAA, COPPA, GDPR special-category, FERPA, PCI-DSS, EU AI Act high-risk categories.
Asymmetric power Actor. Messaging, trading, teams, comments, shared resources - basically any product enabling one user to act on another.
If your product is "just for fun" but a 12-year-old can use it, the Predator-pattern Actor isn't optional anymore. The VRSD Methodology refuses the "just for fun" framing every such scenarioe.
How the methodology is delivered
The methodology runs through every Villain's Hat product, so you can pick the depth that matches your situation.
Free.
Claude Skill or ChatGPT GPT. Names 3-6 Actors, scores VRSD, identifies the blind spot to prioritize. 15 minutes.
€497. 3h live.
Your product, walked through the methodology with Pavitra, on a shared board. You'll receive a written verdict in 48 hours in your email.
Waitlist open.
8 specialist analysts run on your product. Web-searched precedent. Downloadable PDF dossier. Launches second half of 2026.
€6,000/month. Two slots maximum.
Embedded in your product planning. Included is VRSD investigation for every new feature, pre-spec.
Start with the free Quick Check. Just 15 minutes and you'll have real actors named and the blind ppot identified.