A penetration test, a vulnerability scan, an audit, an insurance questionnaire and a vendor review each hand you a list. None of them tells you which three things matter most, who owns them, or what leadership has agreed to live with.
Left in their reports, findings are noise. The day a customer, an auditor or the board asks what you are doing about your risks, the answer has to be one list, owned and dated.
Risk management is not one problem. It is five, and a spreadsheet of findings solves the first one at best.
1. Findings are scattered. They live in a dozen reports, scored a dozen ways, and nobody can see them all at once.
2. Nothing is ranked or owned. Every finding looks urgent, and none of them has a business owner who has to answer for it.
3. Fixes slip and nobody notices. Due dates move, remediation is marked done without proof, and a critical finding sits untouched for months.
4. Risks are accepted in the hallway. Someone decides to live with a risk, nobody records who had the authority, and the decision never expires.
5. Leadership never sees it. No regular review, no report, no agreed method, and nothing to show an auditor, an insurer or the board.
START HERE, FREE
Twenty-four questions across eight capabilities and fifteen minutes. The Security Risk QuickStart Assessment places you at Reactive, Emerging, Managed or Integrated, and you only reach Integrated when every capability is at least half-way there, because a program is only as strong as its weakest part.
Measures: all five parts.
Solves: none of them, on purpose. It tells you which capability to fix first.
SECURITY RISK REGISTER STARTER, $9
Everything in one workbook: a register with defined one to five scales before and after your existing controls, treatment, an action tracker, an exception tracker, risk acceptance and a one-page report.
Solves part 1. Every finding in one register, scored the same way.
Solves part 2. Inherent and residual scores and a business owner for every risk put the ones that matter at the top.
Starts part 3. An action tracker for each treatment. Due dates by severity and flags for overdue or unproven fixes are in the Toolkit.
Solves part 4. Accepted risks carry a justification, compensating controls and an expiry, and the workbook checks the approver had enough authority for the risk.
Starts part 5. A monthly review agenda and a one-page risk report. The method, policy and charter are in the Program.
SECURITY RISK AND REMEDIATION TOOLKIT, $39 AT LAUNCH
This is where the rest of a security program meets: findings from vendor reviews, identity reviews, tests, scans, audits and incidents in one place, reviewed every month.
Solves parts 1 and 2, with the full register: asset, threat, vulnerability, likelihood, impact, existing controls, residual risk, owner and treatment.
Solves part 3. A remediation tracker for findings from ten sources sets due dates from severity and flags overdue items, self-validation, missing evidence, unlinked critical findings and every extended due date.
Solves part 4. An acceptance register checks each approval against the authority the residual rating requires and flags acceptances that run too long.
Starts part 5. A live monthly agenda, a decision log and a dashboard with a heat map, aging and trend. There is no charter, policy or agreed method yet.
SECURITY RISK MANAGEMENT PROGRAM-IN-A-BOX, $129 AT LAUNCH
A register is a tool. A program decides how it is used: who can accept what, how risk is scored, what happens when remediation is late and how often leadership looks. Adopt it in ninety days, after studying a fully worked example of a program six months in.
Solves parts 1 to 4, with the full Toolkit workbook, extended with ten program metrics, a quarterly maturity review with history and a 90-day plan tracker.
Solves part 5. A Risk Management Charter, Policy and Methodology, a Risk Scoring Model with impact scales and a heat map, a Risk Metrics Standard, and procedures for remediation, acceptance, exceptions, the monthly review and a quarterly maturity review scored on the same four levels as the free assessment.
Aligned to NIST CSF 2.0 GV.RM and ID.RA, NIST IR 8286, NIST SP 800-30 and ISO/IEC 27001:2022 risk requirements. It supports those requirements; it does not certify against them.
Even a complete program needs someone to run it: to chair the monthly review, push back on a late fix, and tell leadership plainly which risks they are carrying. If you want that person, the practice provides senior security leadership on retainer.
Take the free assessment first. If you score Reactive, start with the Starter. If you score Emerging or Managed, go straight to the Toolkit. If leadership, an auditor or an insurer wants a written, approved method, choose the Program.
Yes. Right after checkout, each tier offers the next one at a discount that credits what you already paid, so starting with the Starter costs you nothing extra.
No. It is where the scanner's findings, and every other source's, become owned decisions. Keep the tools; this is the system around them.
