Vailor: the sovereign AI-native GRC alternative to LogicManager

Operational risk is the risk of loss arising from inadequate or failed internal processes, people and systems, or from external events. The definition comes from banking supervision and has spread well beyond it. It covers fraud, human error, equipment failure, the failure of a supplier, regulatory breaches, and digital risk belongs to that list. Cyber is therefore not a discipline standing on its own: it is one family of operational risk, with the particularity of being handled by its own team, its own method and its own vocabulary.

Because it is produced by a different team, on its own rating scales and to its own timetable. A cyber assessment reasons in threat scenarios, vulnerabilities and controls, while the operational register reasons in losses, degraded processes and business impact. The two often describe the same event without ever meeting. Executives then receive two pictures they cannot lay on top of each other, and settle budgets without seeing which exposure actually weighs the most.

By rating it on what it costs the business rather than on its technical difficulty. That is what EBIOS RM contributes: the first workshop identifies the business values at stake and the feared events attached to them, and severity is measured by the damage done to those missions, in the same language as a supply interruption or a processing error. Vailor keeps that chain unbroken, from the supporting asset through to the business impact, so a cyber scenario can enter a wider risk map without being restated in other terms.

Vailor is a GRC platform for digital risk and the compliance that comes with it: that is where formalised methods and frameworks, such as EBIOS RM or NIS2, give the AI solid material to read. The enterprise foundation mirrors your entities, perimeters and assets, and every assessment attaches to them. Scenarios, their severity ratings and their treatment plans are structured and documented, which makes them legible to the risk function, which can carry them into its own register without going back to the technical documents. If you have your own assessment method, it can be integrated through custom development.

The usual split follows the three lines model: the business owns and treats the risk, the control functions (risk, compliance, security) set the method and challenge the ratings, and internal audit assesses the whole independently. The CISO belongs to the second line: not the owner of the risk, but the one who organises its assessment. Vailor is built on that logic. The business starts its pre-assessment in self-service, security then qualifies the project, and fine-grained rights, with custom roles, keep each role in its place.

Start with the frame, not with the risks: entities, perimeters, assets and rating scales are modelled first, then the existing assessments are attached to that structure. It is also the moment to decide what is carried over as it stands, what is requalified and what is archived, since a register that has run for several years accumulates lines with no owner and no review date. Once the frame is set, the AI reads each project's documents and prefills the assessment from excerpts, and your experts validate.