[{"data":1,"prerenderedAt":2224},["ShallowReactive",2],{"page-\u002Frisk-assessment\u002Fthe-risk-register":3,"navigation":1909},{"id":4,"title":5,"body":6,"description":1901,"extension":1902,"meta":1903,"navigation":1904,"path":1905,"seo":1906,"stem":1907,"__hash__":1908},"docs\u002F05.risk-assessment\u002F07.the-risk-register.md","The Risk Register",{"type":7,"value":8,"toc":1854},"minimark",[9,13,22,29,32,38,43,46,55,72,80,84,91,104,111,122,129,138,141,299,328,332,339,344,347,394,400,404,407,434,438,441,461,464,529,536,552,556,562,611,614,632,636,643,736,749,753,756,785,792,810,817,822,825,831,897,900,916,939,946,949,961,964,1004,1035,1038,1045,1075,1078,1095,1112,1124,1128,1132,1135,1188,1203,1216,1221,1225,1232,1252,1255,1259,1269,1292,1302,1307,1310,1317,1321,1334,1337,1426,1430,1441,1445,1448,1466,1469,1474,1478,1486,1490,1493,1514,1517,1521,1530,1534,1537,1666,1673,1683,1687,1694,1697,1708,1712,1748,1752,1759,1762,1766,1776,1780,1783,1787,1790,1794,1800,1804,1813,1817],[10,11,5],"h1",{"id":12},"the-risk-register",[14,15,16,17,21],"p",{},"The ",[18,19,20],"strong",{},"Risk Register"," is where your team records and manages the real risks your organisation is carrying — on top of, but separate from, what the analysis computed for you. Each entry is written by a person: a plain-language risk statement, your own assessment of how likely it is and how much it would hurt, the findings and elements from the analysis that back it up, a treatment decision, an owner, a review date, and a reference handle you can quote in a ticket or a board pack.",[14,23,24,25,28],{},"The register is the one place in the report you ",[18,26,27],{},"author",". Everything else — the findings, the coverage numbers, the severity bands, the matrices — is computed from your model and frozen into the report. The register sits alongside those numbers without ever touching them.",[14,30,31],{},"This guide walks through the full workflow: authoring a risk, backing it with evidence, recording a treatment, managing reference handles, feeding new evidence to a risk you already wrote, filtering and closing risks, reading the review markers the register raises for you, and working with risks recorded from Threat Patterns.",[14,33,34],{},[35,36],"a",{"id":37},"isolation",[39,40,42],"h2",{"id":41},"authoring-never-changes-your-computed-report","Authoring never changes your computed report",[14,44,45],{},"This is the register's central promise, and it is worth stating before anything else:",[47,48,49],"blockquote",{},[14,50,51,54],{},[18,52,53],{},"Nothing you do in the register changes the computed analysis."," Authoring a risk, editing it, linking evidence, or deleting it never moves a single finding, coverage number, or severity band — and it never marks your report out of date.",[14,56,57,58,61,62,66,67,71],{},"You can record a hundred risks and your model's computed numbers stay byte-for-byte identical. The amber ",[18,59,60],{},"\"your model changed\""," banner you may have seen elsewhere in the report is about your ",[63,64,65],"em",{},"model"," changing, never about the register. The register raises its own quiet, information-only markers on the individual risk rows (see ",[35,68,70],{"href":69},"#when-a-risk-needs-review","When a risk needs review","), and those markers never escalate into that banner.",[14,73,74,75,79],{},"For the reasoning behind this separation — why management-authored judgment is deliberately kept out of the computed numbers — see ",[35,76,78],{"href":77},"\u002Frisk-assessment\u002Fmethodology-and-trust","Methodology and Trust",".",[39,81,83],{"id":82},"opening-the-register","Opening the register",[14,85,86,87,90],{},"The register lives on the ",[18,88,89],{},"Register"," tab of your model's Risk Assessment report. It holds the risks for that one model.",[92,93,94,98],"ol",{},[95,96,97],"li",{},"Open the Risk Assessment report for your model.",[95,99,100,101,103],{},"Select the ",[18,102,89],{}," tab.",[14,105,106,107,110],{},"The register loads on its own when you open the tab. While it is fetching you see ",[18,108,109],{},"Loading the register…","; once it lands you see the table of risks, or an empty state if none have been authored yet.",[14,112,113,114,117,118,121],{},"The tab header shows a running count — for example ",[18,115,116],{},"4 risks · 3 open"," — followed by a ",[18,119,120],{},"＋ New risk"," button. Below the header sit the four filter controls, and below those the risk table itself. Each row is one risk; click a row to expand it and see its evidence, notes, treatment plan, and actions.",[14,123,124],{},[125,126],"img",{"alt":127,"src":128},"The Register tab: the risk-count header and the + New risk button, the Status \u002F Likelihood \u002F Impact \u002F Treatment filter row, and the risk table with one row expanded to show its two linked findings, its treatment plan and overdue date, and the Edit \u002F Add evidence \u002F Close \u002F Delete actions.","\u002Fguides\u002Frisk-assessment\u002Fimages\u002Fregister-tab.png",[14,130,131],{},[63,132,133,134,137],{},"The Register tab. The count header and ",[18,135,136],{},"+ New risk"," button sit above the Status \u002F Likelihood \u002F Impact \u002F Treatment filters and the risk table. The expanded row shows a risk's linked evidence (here two findings, F6 and F1), its treatment plan and an overdue treatment date, and the row actions — Edit, Add evidence, Close, and Delete.",[14,139,140],{},"The table columns are:",[142,143,149],"div",{"className":144,"tabIndex":146,"role":147,"ariaLabel":148},[145],"table-frame",0,"region","Table: Opening the register",[150,151,152,165],"table",{},[153,154,155],"thead",{},[156,157,158,162],"tr",{},[159,160,161],"th",{},"Column",[159,163,164],{},"What it shows",[166,167,168,188,198,212,225,238,263,276,289],"tbody",{},[156,169,170,176],{},[171,172,173],"td",{},[18,174,175],{},"Ref",[171,177,178,179,183,184,187],{},"The risk's reference handle (see ",[35,180,182],{"href":181},"#reference-handles","Reference handles","). Shows a dash (",[18,185,186],{},"—",") if the risk has none.",[156,189,190,195],{},[171,191,192],{},[18,193,194],{},"Risk",[171,196,197],{},"The full three-part risk statement, rendered as one sentence.",[156,199,200,205],{},[171,201,202],{},[18,203,204],{},"Impact",[171,206,207,208,211],{},"Your assessed impact as a coloured band, or ",[18,209,210],{},"Unscored"," if you have not assessed it.",[156,213,214,219],{},[171,215,216],{},[18,217,218],{},"Likelihood",[171,220,221,222,79],{},"Your assessed likelihood, or ",[18,223,224],{},"unassessed",[156,226,227,232],{},[171,228,229],{},[18,230,231],{},"Evidence",[171,233,234,235,79],{},"How many pieces of evidence are linked — for example ",[18,236,237],{},"2 links",[156,239,240,245],{},[171,241,242],{},[18,243,244],{},"Status",[171,246,247,250,251,254,255,258,259,262],{},[18,248,249],{},"open",", ",[18,252,253],{},"closed",", or ",[18,256,257],{},"stale"," (needs review), plus a ",[18,260,261],{},"review overdue"," flag when the review date has passed.",[156,264,265,270],{},[171,266,267],{},[18,268,269],{},"Treatment",[171,271,272,273,79],{},"The recorded treatment decision. New risks show ",[18,274,275],{},"Undecided",[156,277,278,283],{},[171,279,280],{},[18,281,282],{},"Owner",[171,284,285,286,288],{},"Who owns the risk, or a dash (",[18,287,186],{},").",[156,290,291,296],{},[171,292,293],{},[18,294,295],{},"Updated",[171,297,298],{},"The date the risk was last changed.",[47,300,304],{"className":301},[302,303],"callout","callout-note",[14,305,306,309,310,250,313,254,316,319,320,323,324,79],{},[18,307,308],{},"Note:"," The register is fetched separately from the rest of the report, so it is the one tab that can be genuinely ",[63,311,312],{},"loading",[63,314,315],{},"failed",[63,317,318],{},"unavailable"," — not just empty. If it cannot load you get an honest message and a ",[18,321,322],{},"retry"," link, never a blank table pretending you have no risks. See ",[35,325,327],{"href":326},"#troubleshooting","Troubleshooting",[39,329,331],{"id":330},"author-a-risk","Author a risk",[14,333,334,335,338],{},"Every risk is authored through the same dialog, whether you start from a finding or from a blank slate. Focus always lands on the first statement field, never on ",[18,336,337],{},"Save",", so writing your own words is the default path.",[340,341,343],"h3",{"id":342},"from-a-finding-recommended","From a finding (recommended)",[14,345,346],{},"Starting from a finding pre-fills the risk with what the analysis already knows, so you spend your effort on judgment rather than transcription.",[92,348,349,356,366,382,388],{},[95,350,351,352,355],{},"On the ",[18,353,354],{},"Findings"," tab (or an element or exposure profile), find the finding you want to raise a risk about.",[95,357,358,359,362,363,79],{},"Click its ",[18,360,361],{},"＋ Risk"," action. The authoring dialog opens with the mode selector set to ",[18,364,365],{},"This finding starts a new risk",[95,367,368,369,371,372,375,376,378,379],{},"The finding is attached as evidence automatically, and the statement fields and the ",[18,370,204],{}," may be pre-filled as a ",[18,373,374],{},"draft"," — marked with a small ",[18,377,374],{}," tag and the note ",[63,380,381],{},"\"seeded from the analysis — yours to change.\"",[95,383,384,385,387],{},"Edit the drafted words to state the risk in your own terms. The ",[18,386,374],{}," tag on a field clears the moment you type in it, so you can always see which words are the analysis's and which are yours.",[95,389,390,391,79],{},"Fill in the rest of the risk (assessment, owner, treatment) as described below, then click ",[18,392,393],{},"Create risk",[14,395,396,397,79],{},"For more on findings and how they become evidence, see ",[35,398,354],{"href":399},"\u002Frisk-assessment\u002Ffindings",[340,401,403],{"id":402},"from-scratch","From scratch",[14,405,406],{},"Some risks do not start from a single finding. You can author one from a blank slate and attach evidence later.",[92,408,409,416,422,427],{},[95,410,351,411,413,414,79],{},[18,412,89],{}," tab, click ",[18,415,120],{},[95,417,418,419],{},"The dialog opens empty, with the note ",[63,420,421],{},"\"from scratch — no evidence attached; feed it later from a finding or an element profile.\"",[95,423,424,425,79],{},"Write the risk, assess it, and click ",[18,426,393],{},[95,428,429,430,79],{},"Attach evidence afterwards using the feed workflow in ",[35,431,433],{"href":432},"#add-evidence-to-an-existing-risk","Add evidence to an existing risk",[340,435,437],{"id":436},"the-three-part-statement","The three-part statement",[14,439,440],{},"A risk in the register is never free prose. It is three separate parts that render into one fixed sentence:",[47,442,443],{},[14,444,445,448,449,250,452,448,455,448,458,79],{},[18,446,447],{},"Because"," ",[63,450,451],{},"\u003Ccause>",[63,453,454],{},"\u003Cevent>",[18,456,457],{},"may occur, resulting in",[63,459,460],{},"\u003Cimpact>",[14,462,463],{},"You fill in three fields, each with its own prompt:",[142,465,468],{"className":466,"tabIndex":146,"role":147,"ariaLabel":467},[145],"Table: The three-part statement",[150,469,470,483],{},[153,471,472],{},[156,473,474,477,480],{},[159,475,476],{},"Field",[159,478,479],{},"Prompt in the dialog",[159,481,482],{},"What to write",[166,484,485,500,515],{},[156,486,487,492,497],{},[171,488,489],{},[18,490,491],{},"Cause",[171,493,494],{},[63,495,496],{},"Because… (a present fact)",[171,498,499],{},"The condition that is true today — the thing the risk rests on.",[156,501,502,507,512],{},[171,503,504],{},[18,505,506],{},"Event",[171,508,509],{},[63,510,511],{},"…may occur (the uncertain occurrence)",[171,513,514],{},"The uncertain thing that might happen because of that cause.",[156,516,517,521,526],{},[171,518,519],{},[18,520,204],{},[171,522,523],{},[63,524,525],{},"…resulting in (the effect on objectives)",[171,527,528],{},"The effect on your business or objectives if it does happen.",[14,530,531,532,535],{},"All three are required, and a live ",[18,533,534],{},"preview"," under the fields shows the finished sentence as you type. Each part accepts up to 500 characters, shown by a counter. Because the three parts are stored separately, you can edit any one of them later without disturbing the others — the sentence is assembled fresh every time it is displayed, in the dialog, the table, and any report that quotes it.",[47,537,539],{"className":538},[302,303],[14,540,541,543,544,547,548,551],{},[18,542,308],{}," When you start from a finding that makes no impact claim of its own, the ",[18,545,546],{},"…resulting in"," field is left blank on purpose, with the hint ",[63,549,550],{},"\"the analysis makes no impact claim on this finding — yours to state.\""," You must fill it in before you can save — a risk statement is not complete without its impact.",[340,553,555],{"id":554},"assess-likelihood-and-impact","Assess likelihood and impact",[14,557,558,559,561],{},"Below the statement, two selects capture your own assessment. Both are optional, and leaving either blank is a real, tracked state — ",[18,560,224],{}," — not a hidden zero.",[142,563,566],{"className":564,"tabIndex":146,"role":147,"ariaLabel":565},[145],"Table: Assess likelihood and impact",[150,567,568,581],{},[153,569,570],{},[156,571,572,575,578],{},[159,573,574],{},"Axis",[159,576,577],{},"Values",[159,579,580],{},"Notes",[166,582,583,599],{},[156,584,585,589,592],{},[171,586,587],{},[18,588,218],{},[171,590,591],{},"Rare, Possible, Likely, Almost certain",[171,593,594,595,598],{},"Your probability judgment. ",[18,596,597],{},"The analysis does not compute likelihood"," — this is entirely yours. The field always starts blank.",[156,600,601,605,608],{},[171,602,603],{},[18,604,204],{},[171,606,607],{},"Low, Medium, High, Critical",[171,609,610],{},"Your consequence judgment. When you author from a finding, a suggested value may be seeded here for you to change.",[14,612,613],{},"These are your judgments, deliberately kept in the register's own vocabulary. They are not the same thing as the analysis's exposure or reachability wording elsewhere in the report — \"exposed to the internet\" is a computed fact about your model, not a statement that something is \"Almost certain\" to happen. The register never translates one into the other.",[14,615,616,617,620,621,623,624,626,627,631],{},"Risks that have ",[63,618,619],{},"both"," a likelihood and an impact are placed on the ",[18,622,20],{}," matrix on the report; risks missing either axis are carried honestly in that card's count as ",[63,625,224],{}," rather than being guessed onto the grid. See ",[35,628,630],{"href":629},"\u002Frisk-assessment\u002Freading-the-report","Reading the Report"," for the matrix.",[340,633,635],{"id":634},"owner-review-date-and-the-other-details","Owner, review date, and the other details",[14,637,638,639,642],{},"Open the ",[18,640,641],{},"Details (owner, review date, notes, treatment)"," section of the dialog for the remaining fields. All are optional.",[142,644,647],{"className":645,"tabIndex":146,"role":147,"ariaLabel":646},[145],"Table: Owner, review date, and the other details",[150,648,649,658],{},[153,650,651],{},[156,652,653,655],{},[159,654,476],{},[159,656,657],{},"What it is for",[166,659,660,669,682,691,710,720],{},[156,661,662,666],{},[171,663,664],{},[18,665,282],{},[171,667,668],{},"Free text naming who is accountable. The register models no assignment workflow — it is a label, not a hand-off.",[156,670,671,676],{},[171,672,673],{},[18,674,675],{},"Review by",[171,677,678,679,681],{},"A date (YYYY-MM-DD) when you plan to revisit the risk. Drives the ",[18,680,261],{}," marker. There is no reminder engine — the marker is the whole mechanism.",[156,683,684,688],{},[171,685,686],{},[18,687,580],{},[171,689,690],{},"Free-form context, up to 2000 characters.",[156,692,693,703],{},[171,694,695,250,697,250,700],{},[18,696,269],{},[18,698,699],{},"Treatment plan",[18,701,702],{},"Treatment due",[171,704,705,706,79],{},"Your response decision and its plan — see ",[35,707,709],{"href":708},"#record-a-treatment","Record a treatment",[156,711,712,717],{},[171,713,714],{},[18,715,716],{},"Why this evidence?",[171,718,719],{},"An optional note recorded on the evidence link, frozen at the moment you link it. Available when creating or feeding a risk.",[156,721,722,731],{},[171,723,724,727,728],{},[18,725,726],{},"Reference prefix"," \u002F ",[18,729,730],{},"Reference id",[171,732,733,734,79],{},"The reference handle — see ",[35,735,182],{"href":181},[14,737,738,740,741,744,745,748],{},[18,739,337],{}," stays disabled until the risk is valid, and the dialog always tells you ",[63,742,743],{},"why"," it is disabled — for example ",[18,746,747],{},"Save needs: cause, event, impact",". Fix what it names and the button activates.",[39,750,752],{"id":751},"link-evidence","Link evidence",[14,754,755],{},"Evidence is what grounds a risk in your analysis. Each piece of evidence is a finding, exposure, or element from the report, attached to the risk as its basis.",[757,758,759,777],"ul",{},[95,760,761,762,765,766,769,770,773,774,776],{},"When you author ",[18,763,764],{},"from a finding",", that finding is attached automatically. If several related findings fire on the same data flow, the dialog lists them with checkboxes and a note like ",[63,767,768],{},"\"3 boundary-crossing findings fire on this flow — select the ones this risk is about\""," (with a ",[18,771,772],{},"select all"," shortcut). The finding you clicked ",[18,775,361],{}," on is always included and cannot be deselected.",[95,778,761,779,782,783,288],{},[18,780,781],{},"from scratch",", no evidence is attached at birth; you feed it later (see ",[35,784,433],{"href":432},[14,786,787,788,791],{},"Each linked piece of evidence is shown with its ",[18,789,790],{},"severity band"," as it stood at that moment.",[47,793,794],{},[14,795,796,799,800,803,804,807,808,79],{},[18,797,798],{},"The severity is captured at link time."," When you link a finding, the register records the finding's severity ",[63,801,802],{},"as it is right then"," and keeps that frozen value on the link. It never quietly updates. That frozen value is exactly what lets the register tell you later — plainly, and on that risk's own row — when the finding has moved: ",[63,805,806],{},"\"changed since linked: HIGH → MEDIUM.\""," See ",[35,809,70],{"href":69},[14,811,812,813,816],{},"In an expanded risk row, each evidence link shows its label and finding type, the frozen sentence describing what you were looking at when you cited it, your optional rationale, and a provenance line — ",[63,814,815],{},"\"linked by … on …\""," — recording who attached it and when.",[14,818,819],{},[35,820],{"id":821},"treatment",[39,823,709],{"id":824},"record-a-treatment",[14,826,827,828,830],{},"Every risk carries management's recorded response — modelled on the standard risk-treatment families. Set it with the ",[18,829,269],{}," select in the dialog's Details section.",[142,832,835],{"className":833,"tabIndex":146,"role":147,"ariaLabel":834},[145],"Table: Record a treatment",[150,836,837,846],{},[153,838,839],{},[156,840,841,843],{},[159,842,269],{},[159,844,845],{},"What it records",[166,847,848,857,867,877,887],{},[156,849,850,854],{},[171,851,852],{},[18,853,275],{},[171,855,856],{},"No decision has been made yet. This is the starting state for every new risk, and a legitimate choice to leave in place — the register tracks \"no decision yet\" honestly rather than pretending one exists.",[156,858,859,864],{},[171,860,861],{},[18,862,863],{},"Accept",[171,865,866],{},"You are carrying the risk deliberately.",[156,868,869,874],{},[171,870,871],{},[18,872,873],{},"Mitigate",[171,875,876],{},"You are reducing it with controls.",[156,878,879,884],{},[171,880,881],{},[18,882,883],{},"Transfer",[171,885,886],{},"You are shifting it elsewhere — for example, insurance or a third party.",[156,888,889,894],{},[171,890,891],{},[18,892,893],{},"Avoid",[171,895,896],{},"You are removing the exposure entirely.",[14,898,899],{},"Two optional companions ride alongside the decision:",[757,901,902,907],{},[95,903,904,906],{},[18,905,699],{}," — free prose describing how you will treat the risk (up to 2000 characters). The register never fills this from its own analysis; the words are always yours.",[95,908,909,911,912,915],{},[18,910,702],{}," — a target date (YYYY-MM-DD). Like the review date, it drives an overdue marker (",[18,913,914],{},"treatment overdue",") and nothing more.",[47,917,918],{},[14,919,920,448,923,925,926,928,929,931,932,935,936,938],{},[18,921,922],{},"Note on \"Undecided\".",[18,924,275],{}," is a first-class value, not an empty field. The ",[18,927,269],{}," select has no \"clear\" option, and every new risk starts as ",[18,930,275],{},". This is deliberate: a board's count of ",[63,933,934],{},"risks still awaiting a decision"," depends on being able to tell \"no decision yet\" apart from \"no data.\" When you record a real decision, the register stamps who decided it and when — an ",[18,937,275],{}," risk carries no such stamp.",[14,940,941,942,945],{},"The treatment you record is your ",[63,943,944],{},"management decision",". It is separate from, and never merged with, whether the underlying finding has been dispositioned in the analysis (for example, accepted or affirmed on the Findings tab). A risk can carry a treatment, a finding disposition, both, or a deliberate mismatch — the report shows them side by side and leaves the judgment to you.",[39,947,182],{"id":948},"reference-handles",[14,950,951,952,955,956,960],{},"Every risk carries a ",[18,953,954],{},"reference handle"," — a human-friendly identifier you can quote in a ticket, an email, or a governance pack. A handle looks like ",[957,958,959],"code",{},"DT-CS-260717-4",": a prefix, the date it was created, and a number.",[14,962,963],{},"The handle is generated for you when you create the risk. You do not type it — but you can influence and later edit it:",[757,965,966,991],{},[95,967,968,971,972,974,975,978,979,250,982,250,985,254,988,79],{},[18,969,970],{},"Setting the prefix at creation."," The dialog's ",[18,973,726],{}," field (create only) seeds the prefix. Leave it blank to auto-generate one (the placeholder reads ",[63,976,977],{},"\"auto — a DT-prefixed handle, or type your own\"","), or type your own using 1–12 characters from ",[957,980,981],{},"A–Z",[957,983,984],{},"a–z",[957,986,987],{},"0–9",[957,989,990],{},"-",[95,992,993,996,997,1000,1001,1003],{},[18,994,995],{},"Editing the handle later."," Open a risk, click ",[18,998,999],{},"Edit",", and change the ",[18,1002,730],{}," field — for example, to match an identifier from another system (a GRC tool, a risk committee's minutes). It must be unique within this model, and it cannot be cleared: a risk always keeps a handle once it has one.",[47,1005,1006,1012,1032],{},[14,1007,1008,1011],{},[18,1009,1010],{},"A handle is a lookup, not a ranking."," Treat the reference handle as a name you can search for, not as a position, a score, or a complete sequence:",[757,1013,1014,1020,1026],{},[95,1015,1016,1019],{},[18,1017,1018],{},"Gaps are normal."," Deleting a risk leaves a gap in the numbers. This is expected — the numbers are not a contiguous count.",[95,1021,1022,1025],{},[18,1023,1024],{},"A number can be reused."," Deleting a risk and creating another the same day can reuse the same number.",[95,1027,1028,1031],{},[18,1029,1030],{},"Two risks can, rarely, share a handle."," If two risks are created in the very same instant they can end up with the same handle.",[14,1033,1034],{},"Because of this, the handle is a convenience, not the identity. The reliable identity of a risk is the risk record itself — it is unique, permanent, and never reused, and it is what any export keys on.",[39,1036,433],{"id":1037},"add-evidence-to-an-existing-risk",[14,1039,1040,1041,1044],{},"When you come across a new finding that belongs to a risk you have ",[63,1042,1043],{},"already"," written, feed the evidence to that existing risk instead of authoring a duplicate.",[92,1046,1047,1056,1062,1069],{},[95,1048,1049,1050,1052,1053,1055],{},"Open the new finding (on the ",[18,1051,354],{}," tab, or an element or exposure profile) and click its ",[18,1054,361],{}," action.",[95,1057,1058,1059,79],{},"In the dialog, choose ",[18,1060,1061],{},"This finding feeds an existing risk",[95,1063,1064,1065,1068],{},"Use the ",[18,1066,1067],{},"Add this evidence to…"," picker to choose the target risk.",[95,1070,1071,1072,79],{},"Confirm which evidence to attach, then click ",[18,1073,1074],{},"Add evidence",[14,1076,1077],{},"The picker is built to put the most relevant risk first. It ranks your open risks in three tiers against the finding you are feeding:",[92,1079,1080,1086,1092],{},[95,1081,1082,1083,79],{},"Risks that already have evidence on the ",[18,1084,1085],{},"same element",[95,1087,1088,1089,79],{},"Risks that already have evidence of the ",[18,1090,1091],{},"same finding type",[95,1093,1094],{},"Everything else, newest first.",[14,1096,1097,1098,250,1101,250,1104,250,1107,254,1110,79],{},"Each row shows the risk's impact band and cause on the first line, and its reference handle, owner, status, and evidence count on the second. Type in the picker to filter by the risk's ",[18,1099,1100],{},"cause",[18,1102,1103],{},"event",[18,1105,1106],{},"impact",[18,1108,1109],{},"owner",[18,1111,954],{},[47,1113,1115],{"className":1114},[302,303],[14,1116,1117,1119,1120,1123],{},[18,1118,308],{}," Feeding evidence attaches the finding and nothing more — it does not change the target risk's statement, assessment, or treatment. To change those, edit the risk from the register. The ",[18,1121,1122],{},"Add evidence…"," action on a register row is a signpost to this workflow: because the register tab has no finding in hand, it points you back to where the evidence lives.",[39,1125,1127],{"id":1126},"manage-the-register","Manage the register",[340,1129,1131],{"id":1130},"filter","Filter",[14,1133,1134],{},"Four filters sit above the table. Each is clearable, and they combine — a risk must match all active filters to show.",[142,1136,1139],{"className":1137,"tabIndex":146,"role":147,"ariaLabel":1138},[145],"Table: Filter",[150,1140,1141,1150],{},[153,1142,1143],{},[156,1144,1145,1147],{},[159,1146,1131],{},[159,1148,1149],{},"Options",[166,1151,1152,1161,1170,1179],{},[156,1153,1154,1158],{},[171,1155,1156],{},[18,1157,244],{},[171,1159,1160],{},"Open, Closed",[156,1162,1163,1167],{},[171,1164,1165],{},[18,1166,218],{},[171,1168,1169],{},"Rare, Possible, Likely, Almost certain, Unassessed",[156,1171,1172,1176],{},[171,1173,1174],{},[18,1175,204],{},[171,1177,1178],{},"Low, Medium, High, Critical, Unassessed",[156,1180,1181,1185],{},[171,1182,1183],{},[18,1184,269],{},[171,1186,1187],{},"Undecided, Accept, Mitigate, Transfer, Avoid",[14,1189,1190,1191,1194,1195,1198,1199,1202],{},"Choosing ",[18,1192,1193],{},"Unassessed"," for likelihood or impact is how you find the risks still waiting for a judgment. If the active filters match nothing, the table says so plainly — ",[63,1196,1197],{},"\"0 of 4 risks match the active filters\""," — with a ",[18,1200,1201],{},"clear and show all"," link, so a narrowed-to-empty view is never mistaken for an empty register.",[47,1204,1207],{"className":1205},[302,1206],"callout-tip",[14,1208,1209,1212,1213,1215],{},[18,1210,1211],{},"Tip:"," Clicking a cell on the report's ",[18,1214,20],{}," matrix opens this tab pre-filtered to that cell's open risks — the same filter controls, filled for you.",[14,1217,1218],{},[35,1219],{"id":1220},"status",[340,1222,1224],{"id":1223},"open-and-close-a-risk","Open and close a risk",[14,1226,1227,1228,1231],{},"Closing a risk is a ",[18,1229,1230],{},"soft archive",": the row stays, its history stays, and you can reopen it at any time. Use it for risks that are real but settled.",[92,1233,1234,1237,1246],{},[95,1235,1236],{},"Expand the risk row.",[95,1238,1239,1240,1243,1244,79],{},"Click ",[18,1241,1242],{},"Close",". The status changes to ",[18,1245,253],{},[95,1247,1248,1249,79],{},"To bring it back, expand it again and click ",[18,1250,1251],{},"Reopen",[14,1253,1254],{},"Closed risks drop out of the report's Risk Register matrix (which shows open risks only) but remain in the register table and its count.",[340,1256,1258],{"id":1257},"delete-a-risk","Delete a risk",[14,1260,1261,1262,1265,1266,1268],{},"Deleting is ",[18,1263,1264],{},"permanent",". Use it only for mistaken entries — for real-but-settled risks, use ",[18,1267,1242],{}," instead.",[92,1270,1271,1273,1282],{},[95,1272,1236],{},[95,1274,1239,1275,1278,1279],{},[18,1276,1277],{},"Delete…",". A confirmation appears: ",[63,1280,1281],{},"\"permanent — removes the risk and its evidence links; no undo.\"",[95,1283,1239,1284,1287,1288,1291],{},[18,1285,1286],{},"confirm delete"," to remove the risk, or ",[18,1289,1290],{},"cancel"," to keep it.",[47,1293,1296],{"className":1294},[302,1295],"callout-warning",[14,1297,1298,1301],{},[18,1299,1300],{},"Warning:"," Delete cannot be undone. There is no version history and no recycle bin — a deleted risk and its evidence links are gone. The two-step confirmation is your only safeguard, so read it before clicking through.",[14,1303,1304],{},[35,1305],{"id":1306},"evidence-liveness",[39,1308,70],{"id":1309},"when-a-risk-needs-review",[14,1311,1312,1313,1316],{},"A risk's evidence is frozen at the moment you link it, but your analysis keeps moving. The register watches for the gap and raises quiet, information-only markers on the individual risk rows so you can act on them. ",[18,1314,1315],{},"None of these markers is an alarm, and none of them is the report's \"your model changed\" banner"," — they live entirely on the risk's own row.",[340,1318,1320],{"id":1319},"evidence-that-has-moved-stale","Evidence that has moved (stale)",[14,1322,1323,1324,1326,1327,1329,1330,1333],{},"When a linked finding's severity has changed since you linked it, the risk's ",[18,1325,244],{}," shows ",[18,1328,257],{},", and the expanded row names the move on the evidence line — for example ",[18,1331,1332],{},"changed since linked: HIGH → MEDIUM",". This tells you the basis for the risk has shifted and the risk is worth another look. Re-open the risk, re-check your assessment, and update it if the change warrants it.",[14,1335,1336],{},"Expanded evidence lines can report a few other conditions, each worded to say exactly what is known and no more:",[142,1338,1341],{"className":1339,"tabIndex":146,"role":147,"ariaLabel":1340},[145],"Table: Evidence that has moved (stale)",[150,1342,1343,1356],{},[153,1344,1345],{},[156,1346,1347,1350,1353],{},[159,1348,1349],{},"Marker on the evidence line",[159,1351,1352],{},"What it means",[159,1354,1355],{},"What to do",[166,1357,1358,1370,1387,1400,1413],{},[156,1359,1360,1364,1367],{},[171,1361,1362],{},[18,1363,1332],{},[171,1365,1366],{},"The severity you froze at link time has since moved.",[171,1368,1369],{},"Re-check the risk against the current finding and update your assessment.",[156,1371,1372,1377,1384],{},[171,1373,1374],{},[18,1375,1376],{},"marked … on … by …",[171,1378,1379,1380,1383],{},"The underlying finding has been dispositioned in the analysis — for example accepted or ruled a false positive. (A finding a person has ",[63,1381,1382],{},"affirmed"," as real still counts as live evidence and does not show here.)",[171,1385,1386],{},"Decide whether the risk still stands now the finding has been answered.",[156,1388,1389,1394,1397],{},[171,1390,1391],{},[18,1392,1393],{},"no longer present in the current analysis (was HIGH)",[171,1395,1396],{},"The finding has dropped out of the current analysis. The frozen label keeps it named.",[171,1398,1399],{},"Re-link fresh evidence, or reconsider whether the risk still applies.",[156,1401,1402,1407,1410],{},[171,1403,1404],{},[18,1405,1406],{},"not evaluated by the current snapshot (regenerate)",[171,1408,1409],{},"Your current report predates the analysis that would have looked for this evidence. It was never checked — which is not the same as \"gone.\"",[171,1411,1412],{},"Regenerate the report so the evidence can be evaluated.",[156,1414,1415,1420,1423],{},[171,1416,1417],{},[18,1418,1419],{},"this evidence link predates the current key format",[171,1421,1422],{},"An older link the register can no longer match up.",[171,1424,1425],{},"Review the risk and re-link its evidence if needed.",[340,1427,1429],{"id":1428},"consider-closing","Consider closing",[14,1431,1432,1433,1436,1437,1440],{},"When ",[63,1434,1435],{},"every"," finding behind a risk has been dispositioned or has dropped out of the analysis, the expanded row shows a single prompt: ",[18,1438,1439],{},"\"every finding behind this risk has been dispositioned or removed — consider closing.\""," This is a suggestion, never an action — closing a risk is always something you do yourself. A risk whose findings were all answered may still be a real risk you are carrying deliberately, so the decision stays yours.",[340,1442,1444],{"id":1443},"overdue-dates","Overdue dates",[14,1446,1447],{},"Two date-based markers appear when a date you set has passed:",[757,1449,1450,1458],{},[95,1451,1452,1454,1455,1457],{},[18,1453,261],{}," — shown beside the status when the ",[18,1456,675],{}," date is in the past.",[95,1459,1460,1462,1463,1465],{},[18,1461,914],{}," — shown beside the treatment due date in the expanded row when ",[18,1464,702],{}," is in the past.",[14,1467,1468],{},"Both are quiet markers. The register never nags on a schedule, and closing a risk is always your call — the markers simply surface work for you to pick up.",[14,1470,1471],{},[35,1472],{"id":1473},"threat-patterns",[39,1475,1477],{"id":1476},"risks-recorded-from-threat-patterns","Risks recorded from Threat Patterns",[14,1479,1480,1481,1485],{},"If you also use ",[35,1482,1484],{"href":1483},"\u002Fthreat-patterns","Threat Patterns"," on this model, Threat Patterns can record risks in this register, both on its findings and on the exposures it shows. Each one arrives as a risk with that finding or exposure attached as its evidence. From then on it is a register risk like any other: you can edit its statement, assess it, give it an owner, close it, or delete it.",[340,1487,1489],{"id":1488},"how-they-appear","How they appear",[14,1491,1492],{},"Evidence from Threat Patterns carries a chip in the expanded row:",[757,1494,1495,1501],{},[95,1496,1497,1500],{},[18,1498,1499],{},"Threat Patterns · high"," for a finding, showing the severity Threat Patterns gave the finding when it was recorded.",[95,1502,1503,1506,1507,1510,1511,79],{},[18,1504,1505],{},"Threat Patterns · exposure · high"," for an exposure, showing the exposure's severity when it was recorded. Besides the usual levels, an exposure's severity can read ",[18,1508,1509],{},"none"," or ",[18,1512,1513],{},"unscored",[14,1515,1516],{},"That severity is on Threat Patterns' own scale. It is not one of this report's severity bands, and the register never compares the two.",[340,1518,1520],{"id":1519},"you-decide-the-treatment","You decide the treatment",[14,1522,1523,1524,1526,1527,1529],{},"A risk recorded from Threat Patterns starts as ",[18,1525,275],{},". Its treatment, including whether you accept it, is a management decision you record here, exactly as for a risk you wrote yourself: see ",[35,1528,709],{"href":708},". Threat Patterns records the finding or exposure; the decision stays with you.",[340,1531,1533],{"id":1532},"what-the-evidence-markers-mean","What the evidence markers mean",[14,1535,1536],{},"This report cannot check Threat Patterns evidence against its own analysis, so each time the register loads it asks Threat Patterns whether each finding or exposure still holds. The answer can arrive a moment after the register appears. The evidence line repeats what Threat Patterns answered:",[142,1538,1541],{"className":1539,"tabIndex":146,"role":147,"ariaLabel":1540},[145],"Table: What the evidence markers mean",[150,1542,1543,1553],{},[153,1544,1545],{},[156,1546,1547,1549,1551],{},[159,1548,1349],{},[159,1550,1352],{},[159,1552,1355],{},[166,1554,1555,1568,1588,1601,1618,1636,1653],{},[156,1556,1557,1562,1565],{},[171,1558,1559],{},[63,1560,1561],{},"(no marker)",[171,1563,1564],{},"Threat Patterns still shows it as it was recorded.",[171,1566,1567],{},"Nothing.",[156,1569,1570,1575,1585],{},[171,1571,1572],{},[18,1573,1574],{},"changed since linked: high → critical",[171,1576,1577,1578,1581,1582,79],{},"The severity has moved since it was recorded. When only a finding's details moved, the line reads ",[18,1579,1580],{},"changed since linked: legs or confidence","; for an exposure it reads ",[18,1583,1584],{},"changed since linked: name or who added it",[171,1586,1587],{},"Re-check the risk against what Threat Patterns shows now and update your assessment.",[156,1589,1590,1595,1598],{},[171,1591,1592],{},[18,1593,1594],{},"no longer found by Threat Patterns (was high)",[171,1596,1597],{},"Threat Patterns no longer produces this finding on this model.",[171,1599,1600],{},"Open Threat Patterns to see why, then decide whether the risk still stands.",[156,1602,1603,1608,1611],{},[171,1604,1605],{},[18,1606,1607],{},"no longer on its element (was high); if it was raised again it is a new item: link the new one",[171,1609,1610],{},"The exposure is no longer on the element it was recorded on: it was removed, or the element was deleted.",[171,1612,1613,1614,79],{},"See ",[35,1615,1617],{"href":1616},"#when-an-exposure-comes-back","When an exposure comes back",[156,1619,1620,1624,1629],{},[171,1621,1622],{},[18,1623,1376],{},[171,1625,1626,1627,1383],{},"The exposure has been dispositioned on the platform, for example accepted or ruled a false positive. (An exposure a person has ",[63,1628,1382],{},[171,1630,1631,1632,79],{},"Decide whether the risk still stands now the exposure has been answered. See ",[35,1633,1635],{"href":1634},"#exposures-that-were-already-dispositioned","Exposures that were already dispositioned",[156,1637,1638,1643,1646],{},[171,1639,1640],{},[18,1641,1642],{},"no current Threat Patterns run on this model",[171,1644,1645],{},"There is no Threat Patterns run to check a finding against: Threat Patterns has not been run on this model yet, or every run on it was made by an earlier version of Threat Patterns.",[171,1647,1648,1652],{},[35,1649,1651],{"href":1650},"\u002Fthreat-patterns#run-the-analysis","Run Threat Patterns"," on this model.",[156,1654,1655,1660,1663],{},[171,1656,1657],{},[18,1658,1659],{},"from Threat Patterns: open Threat Patterns to check it",[171,1661,1662],{},"The register could not get an answer, for example because Threat Patterns is not installed or the check failed. Nothing is known about the evidence either way.",[171,1664,1665],{},"Open Threat Patterns and check it there.",[14,1667,1668,1669,1672],{},"If the Threat Patterns run a finding was recorded from no longer exists, Threat Patterns answers from the model's latest run, and the line says so: ",[18,1670,1671],{},"judged on the latest Threat Patterns run",". An exposure is checked against your model as it is now, not against a run, so this never applies to one.",[14,1674,1675,1676,1678,1679,1682],{},"Each of these markers makes the risk ",[18,1677,257],{},", worth a review, with one exception: a disposition the exposure already had when the risk was recorded (see below). The four markers that say a finding is no longer found, an exposure is no longer on its element, there is no current Threat Patterns run, or the register could not ask never lead to ",[18,1680,1681],{},"consider closing",": none of them is a reason to suggest closing a risk. A disposition can, as described next.",[1684,1685,1617],"h4",{"id":1686},"when-an-exposure-comes-back",[14,1688,1689,1690,1693],{},"An exposure keeps its identity for as long as it stands. If it is removed and later raised again, the platform treats it as a new item, even when it looks the same. The link on your risk still points at the old one, so it reads ",[18,1691,1692],{},"no longer on its element"," rather than quietly reading as current again. If the exposure is back, link the new one to this risk from Threat Patterns.",[1684,1695,1635],{"id":1696},"exposures-that-were-already-dispositioned",[14,1698,1699,1700,1702,1703,1705,1706,79],{},"You may record a risk on an exposure your team has already dispositioned, for example one you accepted. That disposition is the reason the risk exists, so the register treats it as expected: the evidence line still shows ",[18,1701,1376],{},", but it does not make the risk stale and never leads to ",[18,1704,1681],{},". A disposition made after the risk was recorded counts like any other: it makes the risk stale, and if everything behind the risk has been dispositioned or removed, the register suggests ",[18,1707,1681],{},[340,1709,1711],{"id":1710},"in-the-exports","In the exports",[757,1713,1714,1741],{},[95,1715,1716,1717,1722,1723,1726,1727,1730,1731,1734,1735,1738,1739,79],{},"The register CSV has an ",[18,1718,1719],{},[957,1720,1721],{},"evidence_sources"," column, after ",[957,1724,1725],{},"risk_id",", naming where each risk's evidence comes from by module identifier: ",[957,1728,1729],{},"dethermine-risk-assessment"," (Risk Assessment), ",[957,1732,1733],{},"dethermine-threat-patterns"," (Threat Patterns), or both separated by ",[957,1736,1737],{},";",". It is empty for a risk with no evidence. Findings and exposures from Threat Patterns both count as ",[957,1740,1733],{},[95,1742,1743,1744,1747],{},"In the Risk Committee report, the evidence column of such a risk adds ",[63,1745,1746],{},"\"Includes Threat Patterns findings, judged by Threat Patterns\"",", whether the risk cites a Threat Patterns finding or an exposure, so a reader knows the report did not judge that evidence itself.",[39,1749,1751],{"id":1750},"exporting-the-register","Exporting the register",[14,1753,1754,1755,79],{},"The whole register can be exported as a spreadsheet-ready file for import into GRC tooling. That export — and its column layout and safety rules — is covered in ",[35,1756,1758],{"href":1757},"\u002Frisk-assessment\u002Fstakeholder-reports","Stakeholder Reports",[39,1760,327],{"id":1761},"troubleshooting",[340,1763,1765],{"id":1764},"the-register-tab-shows-the-register-could-not-be-loaded","The Register tab shows \"The register could not be loaded.\"",[14,1767,1768,1769,1771,1772,1775],{},"The register is fetched separately from the rest of the report, and that request failed. Click the ",[18,1770,322],{}," link to try again. Nothing is lost — the register is only being ",[63,1773,1774],{},"read",", not written.",[340,1777,1779],{"id":1778},"the-tab-says-the-risk-register-is-unavailable-the-host-platform-is-too-old-to-read-it","The tab says \"The risk register is unavailable — the host platform is too old to read it.\"",[14,1781,1782],{},"Your platform version does not support the register. The report's other tabs still work; ask your administrator about upgrading to enable the register.",[340,1784,1786],{"id":1785},"i-got-this-risk-was-changed-elsewhere-your-unsaved-edits-were-replaced-with-the-current-values","I got \"This risk was changed elsewhere — your unsaved edits were replaced with the current values.\"",[14,1788,1789],{},"Someone else edited the same risk while you had it open. The dialog reloaded the current values so you do not overwrite their change. Re-apply your edit on top of the refreshed values and save again.",[340,1791,1793],{"id":1792},"i-got-this-risk-was-deleted-in-another-session","I got \"This risk was deleted in another session.\"",[14,1795,1796,1797,79],{},"The risk you were editing was deleted elsewhere and can no longer be saved. Copy anything you still need from the dialog, then click ",[18,1798,1799],{},"Cancel",[340,1801,1803],{"id":1802},"the-empty-state-says-no-risks-authored-yet","The empty state says \"No risks authored yet.\"",[14,1805,1806,1807,1809,1810,1812],{},"The register genuinely holds no risks. Author your first one from a finding's ",[18,1808,361],{}," action, from an element profile, or with ",[18,1811,120],{}," on this tab.",[39,1814,1816],{"id":1815},"what-to-read-next","What to read next",[757,1818,1819,1824,1829,1837,1842,1849],{},[95,1820,1821,1823],{},[35,1822,630],{"href":629}," — the computed findings, matrices, and the \"your model changed\" banner the register never triggers.",[95,1825,1826,1828],{},[35,1827,354],{"href":399}," — the findings you link as evidence, and how to raise a risk from one.",[95,1830,1831,1833,1834,1836],{},[35,1832,709],{"href":708}," and ",[35,1835,1758],{"href":1757}," — recording your decisions and exporting the register for GRC.",[95,1838,1839,1841],{},[35,1840,78],{"href":77}," — why the register is deliberately isolated from the computed numbers.",[95,1843,1844,1848],{},[35,1845,1847],{"href":1846},"\u002Frisk-assessment\u002Ffaq","FAQ"," — common questions across the Risk Assessment product.",[95,1850,1851,1853],{},[35,1852,1484],{"href":1483}," — the analysis whose findings can be recorded in this register.",{"title":1855,"searchDepth":1856,"depth":1856,"links":1857},"",3,[1858,1860,1861,1868,1869,1870,1871,1872,1877,1882,1892,1893,1900],{"id":41,"depth":1859,"text":42},2,{"id":82,"depth":1859,"text":83},{"id":330,"depth":1859,"text":331,"children":1862},[1863,1864,1865,1866,1867],{"id":342,"depth":1856,"text":343},{"id":402,"depth":1856,"text":403},{"id":436,"depth":1856,"text":437},{"id":554,"depth":1856,"text":555},{"id":634,"depth":1856,"text":635},{"id":751,"depth":1859,"text":752},{"id":824,"depth":1859,"text":709},{"id":948,"depth":1859,"text":182},{"id":1037,"depth":1859,"text":433},{"id":1126,"depth":1859,"text":1127,"children":1873},[1874,1875,1876],{"id":1130,"depth":1856,"text":1131},{"id":1223,"depth":1856,"text":1224},{"id":1257,"depth":1856,"text":1258},{"id":1309,"depth":1859,"text":70,"children":1878},[1879,1880,1881],{"id":1319,"depth":1856,"text":1320},{"id":1428,"depth":1856,"text":1429},{"id":1443,"depth":1856,"text":1444},{"id":1476,"depth":1859,"text":1477,"children":1883},[1884,1885,1886,1891],{"id":1488,"depth":1856,"text":1489},{"id":1519,"depth":1856,"text":1520},{"id":1532,"depth":1856,"text":1533,"children":1887},[1888,1890],{"id":1686,"depth":1889,"text":1617},4,{"id":1696,"depth":1889,"text":1635},{"id":1710,"depth":1856,"text":1711},{"id":1750,"depth":1859,"text":1751},{"id":1761,"depth":1859,"text":327,"children":1894},[1895,1896,1897,1898,1899],{"id":1764,"depth":1856,"text":1765},{"id":1778,"depth":1856,"text":1779},{"id":1785,"depth":1856,"text":1786},{"id":1792,"depth":1856,"text":1793},{"id":1802,"depth":1856,"text":1803},{"id":1815,"depth":1859,"text":1816},"The Risk Register is where your team records and manages the real risks your organisation is carrying — on top of, but separate from, what the analysis computed for you. Each entry is written by a person: a plain-language risk statement, your own assessment of how likely it is and how much it would hurt, the findings and elements from the analysis that back it up, a treatment decision, an owner, a review date, and a reference handle you can quote in a ticket or a board pack.","md",{},true,"\u002Frisk-assessment\u002Fthe-risk-register",{"title":5,"description":1901},"05.risk-assessment\u002F07.the-risk-register","xi9a5ok2TQOQRNHiqtbELQ0N1fXYRhWQHOPVoTMxFUM",[1910,1965,2000,2055,2088,2121,2134,2204],{"title":1911,"description":1912,"path":1913,"stem":1914,"children":1915,"page":-1},"Platform","Modelling, analysis, findings and controls in the Dethernety platform.","\u002Fplatform","01.platform",[1916,1920,1925,1930,1935,1940,1945,1950,1955,1960],{"title":1917,"path":1913,"stem":1918,"description":1919},"Dethernety User Documentation","01.platform\u002Findex","User guide for the Dethernety threat modeling platform",{"title":1921,"path":1922,"stem":1923,"description":1924},"Quick Start","\u002Fplatform\u002Fquick-start","01.platform\u002F01.quick-start","Install Dethernety on your own machine, draw a four-element model and read its first threat finding.",{"title":1926,"path":1927,"stem":1928,"description":1929},"Building Your First Model","\u002Fplatform\u002Fbuilding-your-first-model","01.platform\u002F02.building-your-first-model","Build a threat model of an online store in about 30 minutes, run a Threat Report on it, and raise an issue from a finding.",{"title":1931,"path":1932,"stem":1933,"description":1934},"Security Analysis Workflow","\u002Fplatform\u002Fsecurity-analysis-workflow","01.platform\u002F03.security-analysis-workflow","How to run security analysis and interpret results to improve your threat models.",{"title":1936,"path":1937,"stem":1938,"description":1939},"Managing Findings","\u002Fplatform\u002Fmanaging-findings","01.platform\u002F04.managing-findings","Record decisions on system-generated exposures and countermeasures — affirm them as confirmed live risk, or mute them as not applicable, false positive, waived, or superseded — instead of deleting them.",{"title":1941,"path":1942,"stem":1943,"description":1944},"Working with Security Controls","\u002Fplatform\u002Fworking-with-security-controls","01.platform\u002F05.working-with-security-controls","Learn how to create, manage, and assign reusable security controls in Dethernety to protect your threat models.",{"title":1946,"path":1947,"stem":1948,"description":1949},"Issue Management Guide","\u002Fplatform\u002Fissue-management-guide","01.platform\u002F06.issue-management-guide","Issue tracking, filtering, and management in Dethernety.",{"title":1951,"path":1952,"stem":1953,"description":1954},"Boundary Trust Zones","\u002Fplatform\u002Fboundary-trust-zones","01.platform\u002F07.boundary-trust-zones","Record each security boundary's trust zone, business domains, operational role, and approved channels to document how your system is meant to be segmented.",{"title":1956,"path":1957,"stem":1958,"description":1959},"Understanding Modules","\u002Fplatform\u002Funderstanding-modules","01.platform\u002F08.understanding-modules","How Dethernety's module system extends your threat modeling capabilities.",{"title":1961,"path":1962,"stem":1963,"description":1964},"Component Configuration Guide","\u002Fplatform\u002Fcomponent-configuration-guide","01.platform\u002F09.component-configuration-guide","Detailed guide on configuring different types of components and their security implications.",{"title":1966,"description":1967,"path":1968,"stem":1969,"children":1970,"page":-1},"BYODt cloud","Deploying the platform yourself and connecting it to the BYODt cloud.","\u002Fbyodt-cloud","02.byodt-cloud",[1971,1975,1980,1985,1990,1995],{"title":1972,"path":1968,"stem":1973,"description":1974},"BYODt Deployment","02.byodt-cloud\u002Findex","Run Dethernety on your own machine: install, configure, operate, and recover",{"title":1976,"path":1977,"stem":1978,"description":1979},"Installing the BYODt Deployment","\u002Fbyodt-cloud\u002Finstallation","02.byodt-cloud\u002F01.installation","Install Dethernety on your own machine: check the requirements, download and verify the signed bundle, start it, and confirm the deployment is healthy",{"title":1981,"path":1982,"stem":1983,"description":1984},"Configuring the BYODt Deployment","\u002Fbyodt-cloud\u002Fconfiguration","02.byodt-cloud\u002F02.configuration","The .env settings reference, the generated secret file, database storage, and how to apply a change",{"title":1986,"path":1987,"stem":1988,"description":1989},"Operating the BYODt Deployment","\u002Fbyodt-cloud\u002Foperations","02.byodt-cloud\u002F03.operations","The byodt command reference and the day-to-day tasks: start, stop, inspect, back up, restore, TLS, upgrade, remove",{"title":1991,"path":1992,"stem":1993,"description":1994},"Connecting the BYODt Deployment to the Cloud","\u002Fbyodt-cloud\u002Fcloud","02.byodt-cloud\u002F04.cloud","Add cloud sign-in and content packages from the operator console, and disconnect again",{"title":1996,"path":1997,"stem":1998,"description":1999},"Troubleshooting the BYODt Deployment","\u002Fbyodt-cloud\u002Ftroubleshooting","02.byodt-cloud\u002F05.troubleshooting","Symptom, cause, and fix for the failures this deployment reports",{"title":2001,"description":2002,"path":2003,"stem":2004,"children":2005,"page":-1},"Dethereal","The Claude Code plugin: build a threat model in conversation and publish it to the platform.","\u002Fdethereal","03.dethereal",[2006,2010,2015,2020,2025,2030,2035,2040,2045,2050],{"title":2007,"path":2003,"stem":2008,"description":2009},"Dethereal — Claude Code Plugin for Threat Modeling","03.dethereal\u002Findex","Comprehensive documentation for the Dethereal threat modeling plugin",{"title":2011,"path":2012,"stem":2013,"description":2014},"Getting Started with Dethereal","\u002Fdethereal\u002Fgetting-started","03.dethereal\u002F01.getting-started","Install the plugin, authenticate, and create your first threat model",{"title":2016,"path":2017,"stem":2018,"description":2019},"The 11-Step Guided Workflow","\u002Fdethereal\u002Fguided-workflow","03.dethereal\u002F02.guided-workflow","Complete walkthrough of the \u002Fdethereal:threat-model guided process",{"title":2021,"path":2022,"stem":2023,"description":2024},"Command Reference","\u002Fdethereal\u002Fcommand-reference","03.dethereal\u002F03.command-reference","Complete reference for all 14 Dethereal slash commands",{"title":2026,"path":2027,"stem":2028,"description":2029},"Threat Model Concepts","\u002Fdethereal\u002Fmodel-concepts","03.dethereal\u002F04.model-concepts","Components, boundaries, data flows, classes, attributes, and quality scoring",{"title":2031,"path":2032,"stem":2033,"description":2034},"Discovery and Enrichment","\u002Fdethereal\u002Fdiscovery-and-enrichment","03.dethereal\u002F05.discovery-and-enrichment","Infrastructure scanning, security attributes, MITRE ATT&CK, credentials, and compliance",{"title":2036,"path":2037,"stem":2038,"description":2039},"Sync and Version Control","\u002Fdethereal\u002Fsync-and-version-control","03.dethereal\u002F06.sync-and-version-control","Push\u002Fpull workflow, conflict handling, git integration, and multi-model projects",{"title":2041,"path":2042,"stem":2043,"description":2044},"Review and Attack Surface Analysis","\u002Fdethereal\u002Freview-and-analysis","03.dethereal\u002F07.review-and-analysis","Quality review, attack surface summary, and platform analysis integration",{"title":2046,"path":2047,"stem":2048,"description":2049},"Agents, Tools, and Hooks","\u002Fdethereal\u002Fagents-and-architecture","03.dethereal\u002F08.agents-and-architecture","How the 5 AI agents, 22 MCP tools, and 3 lifecycle hooks work together",{"title":2051,"path":2052,"stem":2053,"description":2054},"Dethereal Glossary","\u002Fdethereal\u002Fglossary","03.dethereal\u002F09.glossary","Definitions for Dethereal-specific terminology",{"title":2056,"description":2057,"path":2058,"stem":2059,"children":2060,"page":-1},"Threat Report","The residual-risk report over a threat model: reading it, filtering it and exporting it.","\u002Fthreat-report","04.threat-report",[2061,2064,2069,2073,2078,2083],{"title":2056,"path":2058,"stem":2062,"description":2063},"04.threat-report\u002Findex","Read, filter, drill into, and export a residual-risk report over a threat model",{"title":2065,"path":2066,"stem":2067,"description":2068},"Getting Started with the Threat Report","\u002Fthreat-report\u002Fgetting-started","04.threat-report\u002F01.getting-started","Generate, open, refresh, and export a threat report over a model",{"title":630,"path":2070,"stem":2071,"description":2072},"\u002Fthreat-report\u002Freading-the-report","04.threat-report\u002F02.reading-the-report","Navigating the report, the shared visual language, and the Posture and Boundary Crossings views",{"title":2074,"path":2075,"stem":2076,"description":2077},"Understanding Coverage and Gaps","\u002Fthreat-report\u002Funderstanding-coverage","04.threat-report\u002F03.understanding-coverage","Reading the MITRE ATT&CK coverage matrix: tiers, prevent vs detect, off-grid notes, and what coverage does and does not mean",{"title":2079,"path":2080,"stem":2081,"description":2082},"Reachability and Flow Routes","\u002Fthreat-report\u002Freachability","04.threat-report\u002F04.reachability","Exploring flow routes to crown-jewel assets and between any two elements — and what the analysis does and does not model",{"title":2084,"path":2085,"stem":2086,"description":2087},"Working with Findings","\u002Fthreat-report\u002Fworking-with-findings","04.threat-report\u002F05.working-with-findings","The Residual Risk ledger, triaging findings, filtering, and the per-element Component Profile",{"title":2089,"description":2090,"path":2091,"stem":2092,"children":2093,"page":-1},"Risk assessment","The risk assessment module: the register, the reports and the method behind them.","\u002Frisk-assessment","05.risk-assessment",[2094,2098,2102,2105,2110,2113,2116,2120],{"title":2095,"path":2091,"stem":2096,"description":2097},"Dethernety Risk Assessment User Guide","05.risk-assessment\u002Findex","Dethernety Risk Assessment turns a threat model you have built on the Dethernety platform into a grounded, board-ready draft risk report. From one point-in-time assessment of your model you get a prioritized worklist, a likelihood × impact risk matrix, a security-coverage posture, ten kinds of finding, a management risk register your team authors and maintains, and audience-tiered stakeholder reports — Board, Risk Committee, and Technical — plus machine-readable data exports.",{"title":2099,"path":1846,"stem":2100,"description":2101},"FAQ and Troubleshooting","05.risk-assessment\u002F01.faq","Short answers to the questions analysts, risk managers, and compliance officers ask most often about the Risk Assessment. Each answer links to the guide that covers it in full.",{"title":354,"path":399,"stem":2103,"description":2104},"05.risk-assessment\u002F02.findings","A finding is a specific observation the Risk Assessment makes about your threat model. Every finding is grounded in something concrete you have declared — an element, a data flow, a trust zone, a crown jewel — and it points you at a place worth a closer look. This guide is the reference to open when you see a finding and want to know what it means and what to do about it.",{"title":2106,"path":2107,"stem":2108,"description":2109},"Getting Started","\u002Frisk-assessment\u002Fgetting-started","05.risk-assessment\u002F03.getting-started","Risk Assessment turns a threat model you have built on the Dethernety platform into a grounded, board-ready draft risk report — a prioritized worklist, a likelihood × impact matrix, a security-coverage posture, ten kinds of finding, a risk register your team authors, and audience-tiered stakeholder reports and exports.",{"title":78,"path":77,"stem":2111,"description":2112},"05.risk-assessment\u002F04.methodology-and-trust","Every number in a Risk Assessment is meant to survive scrutiny. This chapter explains why you can trust the report and — just as importantly — what it deliberately declines to claim, so you can put it in front of your board, a regulator, or an external auditor and defend every line.",{"title":630,"path":629,"stem":2114,"description":2115},"05.risk-assessment\u002F05.reading-the-report","The Risk Assessment turns your threat model into a single, scannable draft risk report: an executive summary at the top and a set of analytical tabs below it. This guide explains how to read what you see — what a matrix cell means, how coverage is stated, what a severity band is (and is not), and how to interpret each tab.",{"title":2117,"path":1757,"stem":2118,"description":2119},"Stakeholder Reports and Exports","05.risk-assessment\u002F06.stakeholder-reports","One assessment produces reporting for every audience you answer to. From a single generated Risk Assessment you can hand your board a one-page brief, give your risk committee the full reconciliation, keep the complete technical detail for your own team, and export the underlying data into your GRC tool — without ever re-running anything or reconciling one document against another.",{"title":5,"path":1905,"stem":1907,"description":1901},{"title":1484,"description":2122,"path":1483,"stem":2123,"children":2124,"page":-1},"The Threat Patterns module and its modelling checklist.","06.threat-patterns",[2125,2129],{"title":2126,"path":1483,"stem":2127,"description":2128},"Threat Patterns User Guide","06.threat-patterns\u002Findex","Threat Patterns finds threats in your model that no single element shows on its own. Each one appears only when several elements line up. For example, an agent may read content anyone can write, hold private data, and be able to send data where an outsider reads it. Each element can look acceptable alone, but together they form a path an attacker can use.",{"title":2130,"path":2131,"stem":2132,"description":2133},"Modelling Checklist","\u002Fthreat-patterns\u002Fmodelling-checklist","06.threat-patterns\u002F01.modelling-checklist","Threat Patterns decides a leg only from what your model states. An unanswered attribute or field is undetermined, never read as \"no\". This checklist lists the facts and drawings the analysis asks for most often. For each one it says where to set it and which leg it settles. Attribute names are shown as they appear on the class, in code.",{"title":2135,"description":2136,"path":2137,"stem":2138,"children":2139,"page":-1},"Agentic modelling","A hands-on training: model one agentic system step by step, with Threat Patterns after each step.","\u002Fagentic-modelling","07.agentic-modelling",[2140,2144,2149,2154,2159,2164,2169,2174,2179,2184,2189,2194,2199],{"title":2141,"path":2137,"stem":2142,"description":2143},"Model an Agentic Architecture","07.agentic-modelling\u002Findex","A hands-on training in modelling systems that run AI agents, so that Threat Patterns can analyse them. You build one system, a fictional customer-support copilot, in eleven short lessons. Each lesson adds one thing to the model, and you run Threat Patterns after each one to see what the change did.",{"title":2145,"path":2146,"stem":2147,"description":2148},"Lesson 1: Draw the Agent and What It Talks To","\u002Fagentic-modelling\u002F01-draw-the-agent","07.agentic-modelling\u002F01.01-draw-the-agent","Training overview · Lesson 1 of 11 · Next: Say what data moves",{"title":2150,"path":2151,"stem":2152,"description":2153},"Lesson 2: Say What Data Moves","\u002Fagentic-modelling\u002F02-say-what-data-moves","07.agentic-modelling\u002F02.02-say-what-data-moves","Training overview · Lesson 2 of 11 · Previous: Draw the agent · Next: Mark who is outside",{"title":2155,"path":2156,"stem":2157,"description":2158},"Lesson 3: Mark Who Is Outside","\u002Fagentic-modelling\u002F03-mark-who-is-outside","07.agentic-modelling\u002F03.03-mark-who-is-outside","Training overview · Lesson 3 of 11 · Previous: Say what data moves · Next: Draw a tool that reaches any host",{"title":2160,"path":2161,"stem":2162,"description":2163},"Lesson 4: Draw a Tool That Reaches Any Host","\u002Fagentic-modelling\u002F04-draw-a-tool-that-reaches-any-host","07.agentic-modelling\u002F04.04-draw-a-tool-that-reaches-any-host","Training overview · Lesson 4 of 11 · Previous: Mark who is outside · Next: State what the agent can do",{"title":2165,"path":2166,"stem":2167,"description":2168},"Lesson 5: State What the Agent Can Do","\u002Fagentic-modelling\u002F05-state-what-the-agent-can-do","07.agentic-modelling\u002F05.05-state-what-the-agent-can-do","Training overview · Lesson 5 of 11 · Previous: Draw a tool that reaches any host · Next: Fix a finding with a fact",{"title":2170,"path":2171,"stem":2172,"description":2173},"Lesson 6: Fix a Finding With a Fact","\u002Fagentic-modelling\u002F06-fix-a-finding-with-a-fact","07.agentic-modelling\u002F06.06-fix-a-finding-with-a-fact","Training overview · Lesson 6 of 11 · Previous: State what the agent can do · Next: Record a compensating control",{"title":2175,"path":2176,"stem":2177,"description":2178},"Lesson 7: Record a Compensating Control","\u002Fagentic-modelling\u002F07-record-a-compensating-control","07.agentic-modelling\u002F07.07-record-a-compensating-control","Training overview · Lesson 7 of 11 · Previous: Fix a finding with a fact · Next: Leave what you don't know open",{"title":2180,"path":2181,"stem":2182,"description":2183},"Lesson 8: Leave What You Don't Know Open","\u002Fagentic-modelling\u002F08-leave-unknowns-open","07.agentic-modelling\u002F08.08-leave-unknowns-open","Training overview · Lesson 8 of 11 · Previous: Record a compensating control · Next: Follow a credential",{"title":2185,"path":2186,"stem":2187,"description":2188},"Lesson 9: Follow a Credential","\u002Fagentic-modelling\u002F09-follow-a-credential","07.agentic-modelling\u002F09.09-follow-a-credential","Training overview · Lesson 9 of 11 · Previous: Leave what you don't know open · Next: Watch what gets into knowledge and memory",{"title":2190,"path":2191,"stem":2192,"description":2193},"Lesson 10: Watch What Gets Into Knowledge and Memory","\u002Fagentic-modelling\u002F10-what-gets-in","07.agentic-modelling\u002F10.10-what-gets-in","Training overview · Lesson 10 of 11 · Previous: Follow a credential · Next: Draw tools from others and hand-offs",{"title":2195,"path":2196,"stem":2197,"description":2198},"Lesson 11: Draw Tools From Others and Hand-offs","\u002Fagentic-modelling\u002F11-tools-and-handoffs","07.agentic-modelling\u002F11.11-tools-and-handoffs","Training overview · Lesson 11 of 11 · Previous: Watch what gets into knowledge and memory",{"title":2200,"path":2201,"stem":2202,"description":2203},"The recipe at a glance","\u002Fagentic-modelling\u002Frecipe-at-a-glance","07.agentic-modelling\u002F12.recipe-at-a-glance","The ten steps of the training on one page. Each lesson teaches one or two of them.",{"title":2205,"description":2206,"path":2207,"stem":2208,"children":2209,"page":-1},"BYODt subscription","Subscribing on the BYODt Portal, and moving a deployment you already run to a new team.","\u002Fbyodt-subscription","08.byodt-subscription",[2210,2214,2219],{"title":2211,"path":2207,"stem":2212,"description":2213},"BYODt Subscription","08.byodt-subscription\u002Findex","Buy content for the deployment you run yourself, and decide where that deployment goes when you buy a team edition",{"title":2215,"path":2216,"stem":2217,"description":2218},"Your Subscription","\u002Fbyodt-subscription\u002Fyour-subscription","08.byodt-subscription\u002F01.your-subscription","Create an account, subscribe by card, and find the values your deployment needs on the portal",{"title":2220,"path":2221,"stem":2222,"description":2223},"Moving a Deployment to a New Team","\u002Fbyodt-subscription\u002Fmoving-a-deployment-to-a-new-team","08.byodt-subscription\u002F02.moving-a-deployment-to-a-new-team","What to do with the deployment you already run once you buy a team edition: three ways forward, best first",1793748186136]