Dethernety Risk Assessment User Guide
Dethernety Risk Assessment turns a threat model you have built on the Dethernety platform into a grounded, board-ready draft risk report. From one point-in-time assessment of your model you get a prioritized worklist, a likelihood × impact risk matrix, a security-coverage posture, ten kinds of finding, a management risk register your team authors and maintains, and audience-tiered stakeholder reports — Board, Risk Committee, and Technical — plus machine-readable data exports.
Its defining promise is that it is honest. There is no AI guessing and no black-box risk score: every number you see is a band, a count, or a coverage ratio you can trace back to something in your own model. The report deliberately under-claims — given the choice between a flattering aggregate and an honest gap, it shows the gap. There is no single score to hide behind and no green "all clear", because a threat model can only tell you what you have drawn, not what is true in production. That restraint is exactly what makes the output defensible in front of a board or an auditor.
Who this guide is for
Security analysts, risk managers, CISOs, and compliance officers who run the assessment on a threat model, read the report, author and maintain the risk register, and produce reporting for their leadership. No engineering knowledge of how the product works internally is assumed — if you can open your model on the platform, you can follow this guide.
Contents
| Guide | What it covers |
|---|---|
| Getting Started | Opening Risk Assessment, generating and refreshing the report, and a tour of the dashboard |
| Reading the Report | Interpreting the dashboard: the risk matrix, coverage posture, severity bands, and the analytical tabs |
| Findings | The ten finding types explained — why each appears and what to do about it |
| The Risk Register | Authoring and managing risks: statements, ratings, evidence, treatments, reference handles, the feed picker, and evidence liveness |
| Stakeholder Reports | The Board / Risk Committee / Technical reports, the governance disclaimers, and the JSON and CSV (GRC) exports |
| Methodology and Trust | How to trust and defend the numbers: grounded and reproducible, what they mean and don't, and why there is no green and no single score |
| FAQ | Common questions, troubleshooting, and a plain-language glossary |
Recommended reading order
- First time using Risk Assessment: Getting Started → Reading the Report → Findings.
- Running the risk register: The Risk Register → Stakeholder Reports.
- Reporting to leadership or audit: Stakeholder Reports → Methodology and Trust.
- Quick answers and definitions: FAQ.