Vailor: the sovereign AI-native GRC alternative to RiskHunter

More than a list of threats. A usable risk map ties four things together: the business activities and the assets that support them, the risk scenarios targeting those assets, a rating of likelihood and impact on scales agreed in advance, and a named owner for every risk. Without that owner it stays a document; with them it becomes a decision tool. The heatmap everyone asks for comes last: it is a view of the data, not the method that produced it.

Raw risk level alone will not order a plan. Three criteria combine: how badly a scenario would hurt the organisation's missions, the cost and effort of the control being considered, and whether a regulatory or contractual requirement leaves you no choice. Then comes the treatment decision itself, along the options described in ISO/IEC 27005: reduce, share, avoid or accept the risk. Prioritising also means owning what you will not treat this year, and writing it down.

Not the security team on its own. ISO/IEC 27001 expects the risk owner to approve the treatment plan and formally accept the residual risk, because the decision belongs to whoever runs the activity at stake. In practice that means acceptance criteria agreed before the assessment, a timestamped record of who accepted what and on what grounds, and a fixed review date. That record is what makes the exercise defensible in front of an auditor or a risk committee.

Vailor supports EBIOS RM natively, from framing business values and risk sources through strategic and then operational scenarios, all the way to the treatment plan. The AI reads the project documents and prefills the fields, citing the excerpts it relies on; your teams confirm, correct or reject. The measures you keep join the action plan with their effort, cost and priority, and the risk register stays linked to that plan rather than frozen in a deliverable.

A fixed annual refresh rarely matches how fast the estate changes. Pair a periodic review with event-driven updates: a new application going live, a new supplier handling sensitive data, a significant incident, a regulatory change, an architecture rework. Any of these can create a scenario, move a likelihood rating or make a control obsolete. The practical question is not when the last review happened, but which risks have gone unreviewed for too long.

Yes, and it starts with an inventory: the register itself, the rating scales in use, the controls in progress and the acceptance decisions already taken. Your scales and matrices are configured in Vailor as they stand, so that historical ratings stay comparable with new ones. Most teams start on a limited scope, long enough to check that the resulting levels behave as expected, then extend. Vailor deploys as SaaS or in your own infrastructure, and your data is hosted in France by default.