Vailor: the sovereign AI-native GRC alternative to Egerie

Workshop 3 builds the strategic scenarios: a risk source pursuing a target objective reaches a business value through the ecosystem, meaning suppliers, service providers and partners. Severity is weighed at that level, carrying on from the feared events rated in workshop 1. Workshop 4 goes one step down and describes the technical operating modes against supporting assets, and that is where likelihood is assessed. Workshop 5 brings the two together: severity and likelihood give the risk level and shape the treatment plan. Work on only one level and you get either an analysis detached from the ground, or a vulnerability list with no business meaning.

The method sets no expected number. An attack path is worth modelling only if it changes a decision: it exposes an unprotected supporting asset, a stakeholder with excessive access, or a missing control. Three properly described paths on a critical scenario beat fifteen variants of the same operating mode, which pad the deliverable without moving the risk level. A useful stopping rule: once an extra path no longer surfaces a new control, that scenario is covered.

Vailor's AI reads the project documents (architecture files, maps, contracts, earlier analyses) and prefills the fields of workshops 3 and 4: strategic scenarios, ecosystem stakeholders, attack paths. Every proposal cites the excerpts it relies on and stays subject to validation, so the judgement call remains with your experts. Objects stay linked from one workshop to the next, from the business values and supporting assets of workshop 1 through to the measures of workshop 5, and every decision is recorded in the audit log.

Accreditation, or homologation, is a decision: a designated authority accepts, for a defined scope and a limited period, the residual risks of a system before it goes live. The supporting file gathers the scope, the risk analysis, the security policy and controls, audit or test results, and the action plan covering the gaps. ANSSI publishes a nine-step accreditation approach and recommends EBIOS RM for the risk analysis itself. Traceability is the sensitive part: the authority signs off residual risks and must be able to see where they came from.

It starts with a scoping workshop that inventories what exists: business values, supporting assets, severity and likelihood scales, scenarios already validated, and the treatment plan under way. Your scales are configured in Vailor as they stand, and the documents you have (spreadsheets, workshop minutes, summary notes) give the AI material to prefill the analysis instead of re-typing everything. One point to watch: rewriting the scales while carrying the analysis over makes historical risk levels incomparable. Carry them over as they stand, then let them evolve at the next iteration.

Accreditation covers a scope and a period, so it does not close the subject. You have to run the action plan attached to the decision, track the accepted gaps and their deadlines, and re-examine the file as soon as the system changes architecture, hosting or scope, rather than waiting for the expiry date. That requires every accepted residual risk to stay linked to the scenario that produced it and to the control meant to reduce it. Vailor keeps that link, which makes the review incremental instead of a full rebuild.