Features
Risk Register Platform
Track, assess, and mitigate risks across your organisation in a structured register that sits alongside your vulnerability data. With customisable controls, linked categories, and real-time risk scoring, you can move from identifying risks to managing them.
Why a risk register matters
Vulnerability management tells you what’s broken. Risk management tells you what it means for your business. The two belong together,and the Attack Surface Center is built to support both in a single, integrated platform.
Structured approach
A formal risk register brings structure to what is often an ad hoc process, ensuring all identified risks are documented, assessed, and owned.
Business context
Risks are assessed by impact and likelihood, connecting technical findings to business consequences in language that resonates beyond the security team.
Compliance and accountability
A documented risk register supports compliance with frameworks like ISO 27001, Cyber Essentials Plus, and SOC 2 by demonstrating that risks are actively managed.
Integrated with your attack surface
Risk records sit alongside your assets and vulnerabilities, and not in a separate spreadsheet, making it easy to link technical findings to business risks.
Centralised Risk Management
Manage all your organisational risks in one place. Create risk records, assign owners, link to relevant assets and vulnerabilities, and track status in real time. The risk register provides a structured, auditable log of every risk your organisation has identified and how you're addressing it.
- Full risk lifecycle: From identification through assessment, mitigation, and review, each risk moves through a defined lifecycle with clear ownership at every stage.
- Risk categorisation: Link risks to categories that reflect your organisation's risk taxonomy, making it easier to report by domain or business area.
- Asset and vulnerability linking: Connect risks directly to the assets and vulnerabilities they relate to, giving each risk entry its full technical context.
Customisable Risk Controls
Define and manage controls that mitigate your identified risks. Controls can be reused across multiple risks to standardise your approach, and classified by type to reflect their function in your risk management framework.
- Control types: Classify controls as Preventive, Detective, Directive, or Corrective to reflect how they function within your broader risk framework.
- Reusable control library: Build a library of controls that can be applied across multiple risks. Create your own or start from our pre-built templates.
- Control effectiveness tracking: Monitor whether controls are in place and effective, providing visibility into residual risk after mitigations are applied.
Real-time Risk Scoring
Risk severity is calculated dynamically from impact and likelihood ratings, giving you an immediate, comparable view of priority across your risk register. Visual indicators surface high-priority risks at a glance.
- Impact and likelihood matrix: Assess each risk on both axes: how severe the consequences would be, and how likely the risk is to materialise, to generate a consistent, comparable score.
- Dynamic recalculation: Scores update automatically as you update impact or likelihood ratings, or as controls are applied and residual risk changes.
- Visual priority indicators: High-priority risks are visually highlighted in the register, making it immediately clear where attention is most needed.
See Risks at a Glance
The risk register table view gives you a filterable, sortable overview of every risk in your organisation. Filter by severity, status, category, or owner to find exactly what you need and export for stakeholder reporting when required.
- Flexible filtering: Filter by severity, status, category, review date, or assigned owner to focus on the risks that need immediate attention.
- Status tracking: Track each risk through statuses that reflect its current state: Open, Under Review, Mitigated, Accepted, or Closed.
- PDF export: Export risk reports as PDFs to share with senior stakeholders, auditors, or as part of compliance submissions.
Bring structure to your risk management
Sign up and start building a risk register that connects your technical findings to your business risks.
Common questions
A Risk Register is a structured log of risks identified within your organisation, from cybersecurity gaps and compliance issues to operational failures. It serves as a central record for documenting, assessing, and managing risks, with each entry capturing the risk description, impact, likelihood, owner, controls, and current status.
Vulnerability management focuses on specific technical weaknesses in your assets. The Risk Register takes a broader business view: a risk might be driven by a cluster of vulnerabilities, a process gap, a third-party dependency, or a compliance requirement. The two are linked within the platform so technical findings can be connected to business-level risk records.
Yes. You can create your own controls and build a reusable library, or start from our pre-built control templates. Controls can be applied across multiple risks and classified by type to reflect their function in your risk framework.
The Risk Register is available from Standard plans and above. See our pricing page for a full plan comparison.
Yes. Risk reports can be exported as PDFs, suitable for sharing with auditors, senior management, or including in compliance submissions.