Risk Management
Your board asks "what's our risk exposure?" and the answer is a spreadsheet last updated in February. Alvor replaces intuition with a quantitative engine - every risk scored, owned, treated, and tracked through a structured lifecycle.
Who it is for
Appetite that produces a verdict, not a conversation.
Always know the next step, and whether it is yours.
Accepting a risk is a decision with your name on it.
The lifecycle
Every risk follows the same structured path from identification through validated closure. No silent approvals, no gaps in the record.
A risk is submitted with title, description, category, and business context. Alvor assigns it to an assessor and the lifecycle begins. No risk sits unowned.
The product
01 · The register
Not a spreadsheet of scores. Each row carries its owner, its current lifecycle stage and whether it sits inside the appetite your organisation set, so the list tells you where to spend the next hour rather than just what exists.
02 · The dashboard
Critical risks, how many sit above appetite, and whether any review is overdue. The heat map plots every risk on the likelihood and impact scales you defined, and the top risks are ranked by their score rather than by who shouted loudest.
03 · Appetite
Set a threshold per risk category and every risk gets a live verdict against it. The Breaches tab lists what has crossed the line, so appetite is something the register enforces rather than a paragraph in a policy nobody opens.
Real-time visibility
A live dashboard that answers “where do we stand?” in seconds. The board gets numbers, not narratives.
Total Risks
46
Critical
4
Mitigated
18
Overdue
3
Treatment breakdown
Threat intelligence
A built-in library powered by STRIDE and MITRE ATT&CK. Link threats to risks and Alvor recommends controls automatically - ranked by effectiveness.
Spoofing
Identity impersonation attacks targeting authentication systems
Tampering
Unauthorized modification of data at rest or in transit
Repudiation
Actions that cannot be traced back to a specific actor
Info Disclosure
Exposure of sensitive data to unauthorized parties
Denial of Service
Attacks that degrade or destroy system availability
Elevation
Privilege escalation from standard to administrative access
What it replaces
Most risk registers record that a risk exists. The work is deciding what to do about it, and that is the part that usually lives outside the tool.
Instead of
A risk register in a spreadsheet
Free and familiar, with no ownership, no workflow and no trustworthy history.
In Alvor
Named owners, a lifecycle, a hash-chained history, and records that reference the assets and findings behind them.
Instead of
A scoring scale someone else chose
Likelihood and impact definitions you inherited and quietly disagree with.
In Alvor
Your own likelihood labels, five impact dimensions and a 5x5 narrative matrix, edited once and carried into the export's Criteria sheet.
Instead of
Risk acceptance by email
Somebody said yes once, in a thread, and nobody can find it at audit.
In Alvor
A typed acceptor, recorded conditions, a scope, an expiry date and the residual score snapshotted at the decision.
How it connects
Named precisely, because “everything connects to everything” is not a claim anyone can check.
Further reading
Most guides tell you what a security program should look like. This one tells you how to actually build one - from your first risk register to your first audit - without a dedicated security team.
The 5x5 risk matrix is the most widely used tool in security risk management. It is also one of the least effective. Here is how to build a risk practice that actually drives decisions.
Risk Management
Alvor quantifies, visualises, and tracks every risk across your environment - automatically connected to the assets it affects, the controls that mitigate it, and the frameworks it impacts.