Product detail
AvailableA dual-layer IT risk management system: a scenario-centric risk register for broad portfolio management, with FAIR-based quantitative analysis for material risks that need deeper decision support. Connected to real security posture data, not workshops and questionnaires.
What this replaces
How the risk programme runs
The module supports a real IT risk management programme — not just point-in-time analyses. Broad portfolio governance and deep quantitative analysis work together.
Document risks as structured scenarios with business context, asset scope, and threat assumptions — not freeform descriptions.
Connect risk entries to vulnerability findings, attack surface exposures, cloud posture, IAM, configuration, and third-party risk data from the platform.
Evaluate controls by role (preventive, detective, corrective) and effectiveness — not just pass/fail status. Controls influence frequency and magnitude through FAIR-CAM modeling.
Run Monte Carlo simulation for material scenarios. Decompose frequency and magnitude drivers. Produce annualized loss exposure estimates with confidence intervals.
Model how candidate treatments change probable loss exposure. Calculate ROI for each investment option. Present current-vs-future analysis to decision makers.
Deliver executive portfolios with top risks, quantified exposure, appetite breaches, concentration analysis, and treatment posture — readable without security expertise.
Track review cadence, escalation triggers, acceptance expiry, and reassessment needs. Run IT risk as an operational programme, not a quarterly exercise.
Full module capabilities
This is not a compliance checkbox or a standalone calculator. It is a connected IT risk operating system spanning register management, FAIR quantification, signal integration, treatment analysis, and executive reporting.
Register discipline
FAIR quantification built in, not bolted on
FAIR analysis is embedded in the risk register, not a separate tool. Analysts quantify scenarios where deeper decision support is needed, while the rest of the portfolio stays manageable through governance-grade scoring.
Run 10,000-iteration simulations using BetaPERT distributions for expert estimates. Produce loss exceedance curves, Value at Risk, and expected shortfall — the same quantitative rigor used by financial risk professionals.
Model how controls actually change risk — not just whether they pass. Preventive controls reduce frequency. Detective and corrective controls reduce magnitude. Effectiveness is rated, not binary.
Why this is stronger than standalone CRQ or GRC
Risk entries are linked to live vulnerability findings, attack surface exposures, cloud configuration, IAM posture, and vendor risk — not manually maintained assumptions.
Broad portfolio management and deep FAIR analysis coexist. Not every risk needs Monte Carlo, but the material ones get it without leaving the platform.
CISOs and boards see top risks, probable loss exposure, appetite breaches, and treatment posture in concise business terms — not matrix scores or analyst jargon.
Review cadence, escalation triggers, acceptance expiry, and reassessment workflows run continuously. IT risk is managed as a programme, not a one-off exercise.
Built for the full risk programme
Present quantified IT risk exposure to boards and executives in business language. Compare treatment options by probable loss reduction and investment ROI.
Run FAIR analyses with structured scenario decomposition, documented assumptions, and Monte Carlo simulation. Produce defensible loss estimates tied to real posture data.
Manage the day-to-day risk register: ownership, treatment, review cycles, escalation, and evidence linkage — without forcing every risk through full quantitative analysis.
Platform fit
The product stands on its own, but it becomes more valuable when it connects to governance, trust, audit readiness, and operational security in the same system.