Risk, priced in your currency.
Every gap becomes a trackable risk with severity, ownership and treatment - and the whole picture rolls up to an estimated annual loss exposure, modelled on your organisation, in pounds, dollars or euros - the one language a board and an insurer both speak.
A short call about your organisation, then a full demo if it fits - no obligation.
From gap to treated, on the record.
Risks arrive by themselves
Assessment gaps, incident findings and failed live checks all raise risks in the register automatically - discovery is never a separate job.
Prioritise by severity and cost
A shared severity model ranks every risk consistently, and the exposure model shows which fixes actually move the financial number.
Treat with owners and sign-off
Each risk gets an owner, a treatment decision and remediation tasks - and treatment is signed off, leaving the accountability record auditors ask for.
Review and re-model
Review dates keep risks from going stale, and the exposure figure re-models as your posture changes - so the board's number is never last quarter's.
A register that fills itself.
Most risk registers die in a spreadsheet because feeding them is manual. Assura's register is wired into everything else: assessments raise risks from gaps, incidents raise them from findings, and failed checks raise them from your live environment.
- Severity, ownership, treatment and review dates on every risk
- One severity model shared across the whole platform - numbers never disagree
- Treatment sign-off recorded, with who and when
- Remediation tasks your team can actually work through
A number the board can act on.
"Tier 3 of 4" means nothing in a budget meeting. Assura models your posture as an estimated annual loss exposure in your reporting currency - calibrated to your revenue band and data sensitivity, presented as a range because honest numbers come in ranges.
- Range-first: a p10-p90 band with the p50 headline, never false precision
- Calibrated to your organisation - revenue band and data sensitivity
- Assumptions are editable, so the model matches your reality
- See the reduction a remediation programme would deliver, before you fund it
The whole risk discipline, one module.
A register is where risk management starts, not where it ends. The Risk module also runs your incidents, rehearses your response, and watches the threat landscape - all feeding the same register and the same score.
- An incident register with timelines, findings and a report PDF
- Tabletop exercises with facilitator packs and after-action reports
- A threat intelligence feed tuned to actively exploited vulnerabilities
- An Action Centre worklist that pulls every open item into one queue
Six jobs, one place.
Severity, ownership, treatment and review on every risk - fed automatically by assessments, incidents and live checks.
Annual loss exposure in your currency, calibrated to your organisation, with editable assumptions and a modelled p10-p90 range.
Record incidents with a timeline, capture findings, and export an incident report - with findings feeding straight back into risks.
Run attack-scenario walkthroughs with your team, capture decisions and gaps, and export facilitator and after-action packs.
A feed of actively exploited vulnerabilities, so the register reflects what attackers are actually doing this week.
Every open task, treatment and follow-up across the platform in one prioritised worklist - so nothing waits to be remembered.
Asked and answered.
Where do the risks come from?
Mostly from the platform itself: assessment gaps, incident findings and failed live checks all raise risks automatically. You can also add risks by hand - anything you know about that the tooling can't see yet.
How is the exposure figure calculated?
It's an annual loss estimate in the FAIR tradition, calibrated to your revenue band and data sensitivity, with assumptions you can edit. It's presented as a p10-p90 range because honest numbers come in ranges - use it to prioritise and budget, not as an insurance quote.
Can I put this in front of the board?
That's the point. The exposure figure, the register summary and the treatment picture export into board-ready reports in one click - one slide, one number, and the detail behind it if anyone asks.
What does treatment sign-off actually give me?
An accountability record: who decided to accept, mitigate or transfer each risk, when they signed it off, and when it's next due for review. It's exactly the trail auditors ask for and spreadsheets lose.