How Can We Justify Third-Party Dependency Choices After an Incident?

Absolutely agree with the hindsight angle! It's also critical to focus on what you've gained compared to the incident. Would you have implemented something like Cloudflare independently to avoid these issues? More often than not, the blame shouldn't solely fall on the tool itself. If your postmortem blames the tool, it may be missing the mark.

I'm on the same page regarding watching for hindsight bias. One key thing I've noticed lacking is a formal record of decisions made around third-party tools. If you can document what information was available during adoption, the risks you accepted, and what you left out, it gives context when incidents occur. This helps teams reference the original intent instead of arguing about what happened later. I've started creating 'decision clearance' documents to help make accountability clearer for future incidents.

It's important to keep in mind that you often see the decision as a failure only with hindsight. When you made the choice, you likely did so with the best information available at that moment. Sure, some decisions pan out while others don’t, but that's part of the game.