Risk Details

Open a risk’s detail page from the risks list: click a row, or right-click the row → Open risk details. Risk Details is organized into four tabs: the Risk tab (status, scoring, and the evidence model), the Related tab (auto-derived related risks), the Context tab (AI curation and suggested actions), and the Activity log.

Layout

A Return to Risk Manager link at the top of the page steps back to the list. The header shows the risk’s origin, status, and priority as chips (plus an Archived chip when applicable) above the heading, with the action buttons on the right. The four tabs — Risk, Related, Context, and Activity — are always present.

Header Actions

• Add context — opens the Add context dialog to add a note, attach files, or request context from someone outside your workspace.
• Accept — shown only while the risk is in Triage (and not archived); moves it to Open.
• Edit opens the Edit risk dialog to change the Heading, Priority, Status (Triage, Open, In Progress, In Review, or Closed), or Assignee. Workspace admins can also invite a new user by email from the Assignee picker. Save persists; Cancel abandons the changes.
• Archive / Restore: set the risk aside (it stays in the list, greyed out and sorted last), or bring an archived risk back.

Risk Tab

The Risk tab holds the score headline, the Model health card, the Details card (status, assets, ownership), the Risk model card, the Evidence card, a Related glance strip, and Comments.

Status

All risks start in Triage regardless of type. From Triage, Accept (header button) moves the risk to Open; Archive sets it aside without deleting it.

Once open, risks advance through Open → In Progress → In Review → Closed. Change the status from the Edit risk dialog’s Status dropdown, or from the list’s right-click context menu (Change status).

Archive is available from any state, not just Triage — archiving a risk that is already Open or beyond moves it out of the active view in one step without changing its lifecycle status. When archiving from the list’s context menu you may optionally enter a Reason (optional); it is saved as a comment on the risk and logged in the Activity tab. The Archive dialog on the Risk Details page has no reason field.

Archived risks

If a risk is archived, a warning Archived chip appears in the Risk Details header and a Restore button replaces Archive. Archived risks are always shown on the list, greyed out and sorted last. Bring one back with Restore on Risk Details, or Unarchive in the list’s right-click context menu.

Deleting a risk

Archived risks may be permanently deleted if your role includes the deleteRMRisks permission. The Delete permanently option appears in the right-click context menu on the risks list — only when the risk is archived. This is intentionally high-friction: archive first (reversible), then delete (irreversible).

Deleting a risk removes it and all associated data — comments, asset links, revisions, stages, controls, custom field values, keywords, attachments, attack paths, damage scenarios, and any CSI links.

Assets

A risk is linked to one or more Assets, each shown as a chip — the primary asset (chosen at creation) is highlighted and cannot be detached; any additional linked assets show in a secondary color.

Click Manage assets on the Details card to attach or detach assets from this page. The picker supports the same list/tree views, type/property filters, and primary-asset badge as attaching assets from the Risk Manager table’s right-click menu. A risk must always keep at least one asset — if you uncheck every asset, or a detach would leave none, that removal is rejected and the rest of your changes are still applied.

Manage assets is disabled while a save is in progress or while the risk is archived (restore it first).

Ownership and treatment

The Details card shows the risk’s Priority (Unassigned, Low, Medium, High, Critical) and Treatment (how your team plans to handle the risk: Avoid, Reduce, Share, or Retain):

• Priority and Status are changed via the Edit dialog, or from the list’s right-click context menu.
• The assignee is set in the Edit dialog or from the list’s right-click context menu (Assign to…).
• Treatment is read-only here — it is set by applying an AI suggested action on the Context tab.

Scoring

Risk scores are derived automatically from the risk model and the evidence attached to the risk. The Risk score card shows two values:

• Inherent: the score before controls, combining the risk’s Impact and Likelihood.
• Residual (with controls): the score after the controls applied to this risk lower its Likelihood.

Both values are on a 1–5 scale. A risk that is missing an Impact or Likelihood input shows a warning naming what it still needs instead of a score.

Likelihood comes from the linked attack paths. A path with a direct Feasibility rating uses that rating, which overrides the total of its attack steps; otherwise its likelihood comes from the attack-potential points of its steps, and a path with no scored steps counts as High. A threat scenario that carries a Feasibility rating counts as one more path. The path with the highest likelihood band, the easiest one for an attacker, sets the risk’s Likelihood.

Impact comes from the worst impact rating across the linked damage scenarios.

When the risk model gives a dial no input, VSEC falls back to the highest CVSS score across the risk’s evidence. Each dial falls back on its own: CVSS sets Likelihood when there is no attack path or rated threat scenario, and sets Impact when there is no damage scenario.

Model Health

The Model health card shows whether the risk has all the inputs needed to produce a score:

The card’s subtitle reads Complete - both dials have input when a score can be derived, or Incomplete followed by what is still needed. It also shows the evidence count, the last scored date, and the last evidence date so you can spot stale scores at a glance.

Evidence

The Evidence card lists the source-tagged observations that feed the score. Add evidence opens an inline form; each item can also be edited or deleted. Fields:

Adding, editing, or removing evidence re-scores the risk immediately. If the risk has no origin yet, the first evidence item’s source becomes its origin — see Risk Origins.

Risk model

The Risk model card groups the threat scenarios, attack paths, damage scenarios, and controls that drive this risk’s score, and attaches or detaches them:

• Threat scenarios: the Threat Library scenario this risk represents.
• Attack paths: drive Likelihood. The easiest linked path sets the attack feasibility (see Scoring).
• Damage scenarios: drive Impact. The worst impact category across linked scenarios sets the impact rating.

Controls

The Controls section of the Risk model card applies Control Library entries to the risk. Linked controls reduce the residual score, and the risk re-scores live as controls are applied or removed.

Comments

The Comments section accepts text comments and is visible at the bottom of the Risk tab. To attach files to a risk, use the Context tab — uploaded documents become part of the risk’s context.

Related Tab

The Related tab shows risks that are automatically linked to this one based on the asset graph and threat-library relationships. Relatedness is derived on demand — no manual linking is required — and is read-only.

A risk appears in the Related list when it shares one or more of:

• The same primary asset, or a parent or child of it in the asset hierarchy. Only each risk’s primary asset counts.
• A Threat Library entity: threat scenario, attack path, damage scenario, or control.
• A CVE or evidence reference.

Each related risk shows the reason(s) for the relationship as chips: Same asset, Parent asset: <name>, Child asset: <name>, Same threat scenario, Same attack path, Same damage scenario, Same control, or Shares <reference> for a shared CVE or evidence reference. Click a related risk to navigate to its detail page.

A compact glance strip on the Risk tab shows the related count and top reason chips. Click Explore in the strip to jump directly to the Related tab.

Context Tab

The Context tab maintains a living AI-curated understanding of the risk, proposes field updates for human review, and surfaces Suggested actions — structured one-click state transitions. See Risk Context for the full workflow.

Activity

Per-risk change log. An entry is created whenever a field is edited, status changes (accepted, archived, restored), or a file is attached. Comments do not create Activity entries (an archive Reason is logged as part of its archive entry).

Filtering

The filter bar above the log lets you narrow history by any combination of:

Date range reloads the log for the chosen range; User and Action filter the loaded entries. All filters can be combined. Click Clear all filters to reset them at once.

If the filtered result is empty, the log displays “No activity matches your filter.”

If your workspace supports revision comparison, open an entry to compare it side by side with the previous version.