A risk methodology cannot be simpler than the system it is trying to assess.
That is where a lot of protocol ratings start to break. The protocol is a dependency graph, but the methodology treats it like a checklist. Fields are collected, scored, averaged, and compressed into a single number. The process looks structured, but it often removes the structure that actually creates the risk.
In DeFi, one unresolved dependency can affect many parts of the assessment at once. A governance config can change admin risk, upgrade risk, emergency controls, and user exit assumptions. An oracle route can affect pricing, liquidation, NAV, and redemption logic. A bridge dependency can connect risks that look separate inside the report.
So the hard part is not just defining a better framework. The hard part is maintenance. The methodology has to preserve dependencies, evidence trails, unresolved assumptions, scoring impact, and version changes every time the protocol changes.
That does not scale reliably with analysts alone, because coverage growth becomes headcount growth. It also does not work with basic LLM workflows, because the problem is not writing more text. The problem is maintaining structure, checking evidence, and updating the assessment without losing the rationale behind it.
This is the layer risk teams need now – a way to maintain complex methodologies as the systems they assess keep changing.
That is what we are building toward at ResearchTech.