Vailor: the sovereign AI-native GRC alternative to RiskLens

Quantifying a risk means estimating two separate quantities and combining them: how often a feared scenario occurs over a given period, and how much loss it causes when it does. The honest output is not a single figure but a range of losses with probabilities attached, usually obtained by sampling from distributions rather than by multiplying two averages. The open FAIR taxonomy, published by The Open Group as Open FAIR, formalises that split. A figure circulated without its assumptions cannot be challenged, and a figure nobody can challenge settles no decision.

Three families of it. Scope first: business values, supporting assets and dependencies, otherwise you are pricing something undefined. Costs next: the cost of an hour of downtime for the activity concerned, recovery and forensic costs, contractual penalties, and, if you carry cyber insurance, the deductibles and limits written into the policy. Frequency last: your own incident history, tickets and declared claims, supplemented by calibrated expert judgement where that history is too thin. The organisation almost always holds this data, scattered across IT, procurement, finance and legal. Collecting it is most of the work.

False precision first: a model returns as many decimals as you ask of it, including for rare events nobody holds a record of. Sensitivity to assumptions next: move the upper bound of one distribution and the result shifts by an order of magnitude, which is why the assumptions must travel with the figure. Scope last: a fine has a price, but physical safety, privacy harm and loss of control over your data do not reduce cleanly to an amount, and they must not drop out of the trade-off simply because they resist modelling. A quantified estimate informs a decision, it does not make it.

Yes, and it is the shortest route. EBIOS RM reasons on ordinal severity and likelihood scales rather than on amounts, but it produces exactly the material a quantified view needs: business values, feared events, and documented strategic and operational scenarios. Financial valuation then attaches to those scenarios, to the handful that drive a real budget decision rather than to the whole catalogue. You keep a method published by ANSSI to run the analysis, and you add a monetary reading only where it changes what you decide.

Vailor does not put a euro figure on the risk for you: it holds the base without which a valuation does not survive scrutiny. Scenarios, scales and treatment plans live in one place, every decision is traced in an audit log with no delete function, and when the AI relies on your documents it quotes the passage, checked word for word: enough to answer an auditor, an insurer or a board committee asking where an assumption came from. Each measure also carries its effort in person-days and its cost, prefilled by the AI and validated by your teams. The time saved on data entry moves to the real work: debating loss assumptions and deciding on treatments.

Start by exporting what is worth keeping: the scenario inventory, the frequency and loss assumptions, the scales used, and the treatment decisions already taken. Vailor's AI reads the documents you upload and prefills the assessment from excerpts instead of making you retype it. Then work through the scenarios that are still live first, keeping earlier estimates as history: changing method or scale moves the amounts, and mixing the two series distorts your trend. Replaying one already quantified scenario in parallel is usually enough to confirm consistency before you switch over.