Two backlogs, one team
The FinOps backlog and the security backlog compete for the same engineers, yet they usually live in different tools with different scoring systems. The result is predictable: whichever team shouts loudest wins the sprint. The risk-adjusted worklist puts both on one scale so the trade-off is explicit.
How items are scored
- Savings from the AWS cost optimizer score at twice their estimated monthly saving in dollars: a $46-a-month gp3 migration scores 92.
- Security findings from AWS, Azure and Google Cloud score by severity: critical 100, high 60, medium 30, low 10.
Both go into one list, sorted by score, with a link to the full recommendation or finding and its remediation steps. Advisory cost ideas without a hard saving are left out, so everything on the list is something you can finish.
Using it in planning
Export the list as CSV at the start of a sprint, take items from the top until the capacity is used up, and re-sync at the end: resolved findings drop off, fixed savings are booked as realized, and the next most valuable items move up. Weekly, this is a lightweight way to keep both the bill and the security score moving in the right direction.