FAQ and Troubleshooting

Short answers to the questions analysts, risk managers, and compliance officers ask most often about the Risk Assessment. Each answer links to the guide that covers it in full.

Refreshing your report

My report says my model changed — what do I do?

Click Recreate. A Risk Assessment is a point-in-time snapshot of your threat model as it stood when the report was generated. When the model's assessed structure changes afterwards, a banner tells you the report may no longer match — regenerating rebuilds every number against the model as it stands now.

The report never updates itself silently, so you always know whether the numbers on screen are current. See Reading the Report for what the banner means and Methodology and Trust for why the report is a snapshot rather than a live scan.

Some update notices are advisory, not alarms. When the underlying ATT&CK/D3FEND reference data changes in a way your assessment does not depend on, no coverage result in your report moved — only displayed details like technique names or reference links may be out of date. Recreate when convenient to pick up the current reference data. See Methodology and Trust.

Scores, colors, and honest numbers

Can I get a single overall risk score?

No — and this is deliberate. Likelihood, impact, and severity are ordinal proxies drawn from your modeled structure, not probabilities or loss estimates, so collapsing them into one number would invent precision the model does not have. The report instead shows a prioritized worklist, a likelihood × impact matrix, and a coverage posture you can each trace back to your model. See Methodology and Trust.

Why is there no green / no "all clear"?

The report is honest by design: it would rather show a gap than a reassuring aggregate. Green reads as "safe", and a threat model can only tell you what it has drawn, not what is true in production — so the palette has no green anywhere, and "covered" or "confirmed" is shown in a positive cyan instead. Absent evidence is shown as absent, never rounded up to a confirmed pass. See Methodology and Trust.

Why does coverage show a count instead of a percentage?

Because the denominator is honest. Coverage is reported as counts across four states — covered, partial, uncovered, and cannot-tell-yet — over the same population of your most severe (High and Critical) findings, so "3 of 8" means exactly that. A single percentage would have to fold the "we cannot tell" cases into one side or the other, turning an unknown into a false pass or a false gap. See Reading the Report and Methodology and Trust.

The risk register

I authored a risk but the matrix didn't change — is that a bug?

No. The management risk register is separate from the computed analysis by design: authoring, editing, or deleting a risk never moves a computed number and never marks your report stale. The likelihood × impact matrix at the top of the report shows what the analysis derived from your model; your authored risks appear in their own risk matrix that shows up once you have an open risk in the register. See The Risk Register.

A risk I linked now shows "needs review" — why?

Because a finding you cited as evidence has moved since you linked it. The register freezes each finding's severity as it read at link time, then compares it to the current report — so a row can flag "changed since linked: HIGH → MEDIUM", or note that the finding is gone or has been dispositioned. It is a marker for your attention, not an error, and nothing is auto-closed. A finding you personally affirmed stays live and will not flag. See The Risk Register.

A risk says "consider closing" — what does that mean?

Every finding behind that risk has been dispositioned or has dropped out of the current report, so there may be nothing left for the risk to track. It is a suggestion, not an instruction — review the risk and close it yourself if you agree. See The Risk Register.

Two risks show the same reference handle — is that a problem?

It is rare and harmless. In the uncommon case where two risks are created in the same instant under the same prefix and day, they can receive the same reference handle. The handle is a convenience for GRC lookup, not the risk's identity — each risk still has its own permanent, unique internal identity, so nothing is confused or overwritten. See The Risk Register.

There are gaps in my reference numbers.

That is normal. Reference handles are not a complete sequence and not a timeline — deleting a risk leaves its number unused, and a same-day delete-then-recreate can reuse one. Do not read the numbering as a count of risks or an order of importance. See The Risk Register.

Can I undo a deleted risk?

No. Deletion is permanent — there is no version history, no recycle bin, and no way to recover a deleted risk. If you only want to take a risk off the active list, use Close instead: a closed risk is archived rather than destroyed and can be reopened. Delete only when you are certain. See The Risk Register.

Reports and exports

How do I get my register into our GRC tool?

Export the register as CSV and import that file into your GRC platform. The CSV is a flat, importable table with a stable column layout you can map once. When you use it as a join key, key on the risk id (risk_id: stable, unique, never empty, and the second-to-last column, just before evidence_sources), not the reference handle. See Stakeholder Reports.

Which report do I send the board versus the risk committee?

There are three audience tiers, all built from the same frozen numbers so they can never disagree:

Board / Executive — a one-page summary: the headline takeaway, the exposed-and-uncovered count, the matrix, and the top risks. Send this to the board.
Risk Committee — the reconciliation view: coverage, the full limitations panel, finding-type summary, the complete register, and where authored risks and computed findings diverge. Send this to the risk committee.
Technical — the complete report with every analyst appendix.

See Stakeholder Reports for what each tier includes and omits.

Is my authored text safe when the CSV is opened in Excel?

Yes. Any cell whose text begins with a character a spreadsheet might read as a formula (=, +, -, @) is neutralized so it opens as plain text and cannot execute. Neutralizing adds a single leading apostrophe to those cells, so a value like -Smith exports as '-Smith — treat the exported value as authoritative, and strip that one leading apostrophe only if you are matching the reference handle exactly against another system. See Stakeholder Reports.

Glossary

Plain-language definitions of the terms used across this report. Each links to the guide that covers it in depth.

Term	What it means
Band	The qualitative severity label — Low, Medium, High, Critical, or Unscored — carried by findings and elements. Never a numeric score. See Reading the Report.
Coverage posture	A four-state summary — covered, partial, uncovered, cannot-tell-yet — of how many of your most severe findings have a modeled control, shown as counts over a shared total. See Reading the Report.
Finding	A single deterministic detection surfaced from your model — either a control gap or an architectural issue. There are ten types. See Findings.
Zoning / data-flow finding	A finding about how data crosses the trust zones you declared, judged against a policy on those zones (finding types F6–F10). See Findings.
Treatment	The management decision recorded on a register risk: undecided, accept, mitigate, transfer, or avoid. See The Risk Register.
Disposition	A status recorded on a finding in the ledger, such as affirmed or risk-accepted. Distinct from a treatment, which sits on a register risk. See Reading the Report.
Reference handle	The human-facing GRC lookup id on each register risk (for example `DT-CS-260717-4`). A handle, not a ranking, and not the risk's stable identity. See The Risk Register.
Evidence liveness	The per-risk check that compares each finding you cited as it reads now against how it read when you linked it. See The Risk Register.
"Needs review"	The marker on a register risk whose linked evidence has moved, been dispositioned, or gone since you cited it. Informational — nothing is auto-closed. See The Risk Register.
Staleness / point-in-time	The report reflects your model at the moment it was generated; if the model changed since, a banner asks you to Recreate. See Reading the Report.
Executive band	The summary block at the top of the report — the matrix, the coverage strip, and the takeaway line — that reads as one unit. See Reading the Report.
Priorities	The ranked worklist that orders findings by promotion rules so the most acute work rises to the top. A rank, never a score. See Reading the Report.
The three report tiers	The Board / Executive, Risk Committee, and Technical exports — the same frozen numbers filtered and framed for each audience. See Stakeholder Reports.