Platform
Every risk with an owner, a rating, a treatment and a date.
The risk register holds what your assessments and scans find, rated on likelihood and impact. Each risk is treated, owned and tracked to closure, and flags itself when an owner or a date is missing.
Status: Mitigating
ExampleNo MFA on the admin console
Inherent risk
Moderate
Residual risk
Low
Impact
High
Pending actions
- No risk owner yet
- No target date set
Where risks come from
Where risks come from.
Each risk records how it was identified, so you can filter the register by source later.
A risk assessment
Risks mapped from your answers, so findings land in the register without retyping.
A vendor assessment
Risks from a vendor’s answers and missing documents, labelled with the vendor name.
You or your cyber expert, by hand
Add a risk from a penetration test, a vulnerability scan, an internal audit or your own observation.
Drafted by VectraIQ
Describe the risk in plain English and VectraIQ drafts the whole record for you to edit.
Several issues can feed one risk without duplicating it. Vendor results arrive from third-party risk.
Inside one risk
What a risk record holds.
Overview, ratings and treatment, all in one record.
Overview
- A title, a category and a plain-language risk statement
- A named owner from your team and a target resolution date
- How the risk was identified
Ratings
- How likely it is to happen
- How bad it would be, across financial, operational, reputational, regulatory and other kinds of impact
- Inherent and residual risk worked out for you
Treatment
- Mitigate, accept, transfer or avoid
- The recommended controls and the assets affected
- How effective you expect the controls to be
Scoring
Three scores, each explained.
You rate likelihood and impact. The rest follows from them.
- Impact
- The average of your impact ratings across the kinds of harm that apply.
- Inherent risk
- Likelihood combined with impact: the risk before any controls.
- Residual risk
- Inherent risk reduced by how effective your controls are: the risk you are living with.
Scores map to one scale of labels, from Very Low to Critical, used for inherent risk, residual risk and impact alike.
No MFA on the admin console
ExampleThe risk is likely to occur, and the impact is high on finances, operations and technology. Existing controls are judged about half effective.
- 1Impact is rated High
- 2Inherent risk is Moderate
- 3Residual risk is Low, after the controls you already have
Adding MFA would make the controls more effective and lower residual risk further. The inherent risk does not change.
Working the register
Know where to look.
Four figures show where the register stands, and a table lists every risk.
Open risks
How many risks are still being worked.
Average risk age
How long the open ones have been open.
Risks requiring action
Open risks with no owner, no target date, or a date already past.
Average risk score
Where the open risks sit after your controls.
The table
Search the register, filter by status, source or residual risk, and export exactly what you see.
Pending actions, per risk
Each open risk lists what is missing, such as an owner, a target date or recommended controls.
Generate with AI
Describe a risk in a sentence. Edit the record it drafts.
VectraIQ turns a short description into a complete draft. A person stays in the loop at every step.
Show how the AI draft works
- 1
You describe it
A category and a plain-English description. Optionally link an open issue for more context.
- 2
VectraIQ drafts
From your description, your company profile and your frameworks, it drafts the risk statement, ratings, recommended controls and affected assets.
- 3
You edit and save
The draft is a starting point. Nothing exists in the register until you review and save it.
Issues work the same way, with the same AI draft. Each issue carries a remediation plan and target and actual resolution dates.
Reports built from the register are covered in reporting and dashboards.
Who does what
Owners act. VectraIQ drafts. Experts keep it honest.
Risk owners on your team
Own the risks assigned to you and keep dates current; Accept or transfer a risk when it is within your tolerance.
VectraIQ
Maps assessment answers to risks; Drafts a complete risk record from a short description.
Your expert team
Reviews drafted risks and corrects ratings with you; Recommends the treatment and the controls behind it.
Fixing what a risk points to is part of the managed program, and the controls behind each treatment come from frameworks and controls.
Questions, answered.
What is the difference between an issue and a risk?
An issue is a gap found now, such as a missing document or a failed check, tracked with a remediation plan and dates. A risk is the potential loss that gap creates, rated by likelihood and impact. Several issues can feed one risk.
Who sets the ratings?
Whoever creates the risk, then your cyber expert reviews them with you. VectraIQ can draft ratings from a description, but they only exist once a person saves the risk.
Can I record a risk I have decided to live with?
Yes. You can mark a risk as accepted, or as transferred when insurance or contract terms cover it, so the decision is on record.
Can I export the register?
Yes. You can export the risks you are looking at, filtered however you need them.
More in the platform
What feeds the register, and what reads it.
- Risk assessmentsRun a risk assessment, score it, and turn the findings into issues and risks.
- Third-party riskAssess vendors, tier them by criticality and keep watching them between reviews.
- Audit and compliancePolicies, controls and evidence kept current, so audit prep is a review.
- Frameworks and controlsOne control library mapped across the frameworks you report against.
- Reporting and dashboardsExecutive dashboards and board reports drafted for your cyber expert to finalize.
- VectraIQThe AI inside the platform: ask where you stand, get insights, draft reports.
See your own risks in one register.
Bring your last assessment, or none, and we will show how it would look and who would own what.