How it works — CyberRisk Protection

How it works

Four phases, each producing what the next one needs

Nothing here works in isolation. The inventory decides which findings matter, the findings evidence the register, the register justifies the spend, and the controls you implement satisfy the frameworks you are assessed against.

Asset and vulnerability discovery

Before you can protect data you have to know where it lives. This phase builds one catalogue of everything that needs safeguarding and finds what is wrong with it.

Digital inventory. Hardware, cloud services, software, databases, data repositories, and third-party suppliers, each with the business context that later decides its priority: criticality, data classification, regulated scope, and who owns it.
Flaw detection. Import from Nessus, Tenable, OpenVAS, or a CSV. Column names are matched against aliases rather than fixed, so a spreadsheet from any tool works without a mapping exercise. A built-in TCP discovery scanner finds listening services where you run an instance inside the network.
Attack surface mapping. Relationships between assets form a graph. The product walks it from every internet-facing entry point and ranks the routes by the chance of traversing each hop multiplied by the value of what sits at the end.

Risk assessment and prioritisation

A mid-sized enterprise sees tens of thousands of open findings. This phase turns that into a list somebody can actually work through, and into numbers a board will accept.

Prioritisation that reflects reality. CISA KEV listing, EPSS exploit probability, exploit maturity, asset criticality, and network exposure combine into one score from 0 to 100, with the reasoning shown beside it. A CVSS 7.5 that attackers are using outranks a CVSS 9.8 that nobody has ever exploited.
The risk register. Every scenario logged centrally, assessed inherent, residual, and target, banded against your own thresholds, and flagged when it sits outside the appetite your board signed off.
Financial impact modelling. Loss event frequency multiplied by a three-point magnitude estimate, simulated ten thousand times. You get the expected annual loss, the median year, and the ninety-fifth percentile year that actually drives insurance and reserve decisions. Components are itemised: downtime, breach response, regulatory penalty, incident response, legal, and churn.

Mitigation and remediation workflow

Analysis that nobody acts on is expensive decoration. This phase is where the product stops describing problems and starts tracking whether they were fixed.

Action plans. Findings map to a remediation type, so the recommendation is specific: apply this patch, enable MFA on this group, isolate this host, rotate this credential.
Routing and deadlines. Tasks go to the asset owner by default, with a deadline derived from your own SLA policy. Internet-facing assets get a shortened window automatically, and a CISA-mandated deadline overrides a more generous internal one.
Accountability. SLA adherence is measured over a trailing ninety days, so one bad week does not dominate and a long-past improvement does not flatter the figure. Blocked work is visible as a column that will not empty.

Compliance and continuous monitoring

A digital environment changes daily, so a point-in-time assessment is out of date the moment it is signed.

Framework alignment. NIST CSF 2.0 with implementation tiers, ISO/IEC 27001:2022 Annex A, and CIS Controls v8.1. Map a control once and it satisfies the matching requirement in every framework at the same time.
Regulatory evidence. Evidence attaches where the assessor will look for it, carries a SHA-256 hash so you can prove it has not been altered since collection, and has an explicit validity window because a screenshot from two years ago proves nothing about today.
Executive reporting. One posture score with the trend behind it, the annualised exposure, the risks outside appetite, and the framework scores. Written for somebody deciding a budget, not for somebody reading a scanner.

What it deliberately does not do

Being clear about the edges is more useful than a feature list that implies everything.

It is not a vulnerability scanner

The built-in scanner does host and service discovery only. Depth of vulnerability detection comes from the scanner you already run and trust; this imports its output and decides what to do about it.

It does not patch anything

Tasks route to the people and systems that do. Giving a risk platform write access to production is a larger risk than most of the ones it would be tracking.

It will not tell you a risk is gone

Control reductions are capped and combine with diminishing returns. An extreme risk with an excellent control set lands at medium, not negligible, because that is what is actually true.

It is not a substitute for judgement

Every number traces back to an input you can see and change. The point is to make the assumptions arguable, not to produce an answer nobody can question.

See it with a populated register

Every trial starts with a worked example organisation, so you can judge the output rather than an empty screen.

Start a free trial See pricing