Risk Details
Open a risk’s detail page from the risks list: click a row to open its preview drawer and choose Open details, or right-click the row → Open risk details. Risk Details is organized into four tabs: the Risk tab (status, scoring, and the evidence model), the Related tab (related risks), the Context tab (AI curation and suggested actions), and the Activity log.
Layout
A Return to Risk Manager link at the top of the page steps back to the list. The header shows the risk’s origin, status, and priority as chips (plus an Archived chip when applicable) above the heading, with the action buttons on the right. The four tabs — Risk, Related, Context, and Activity — are always present.
Header Actions
- Add context — opens the Add context dialog to add a note, attach files, or request context from someone outside your workspace.
- Accept — shown only while the risk is in Triage (and not archived); moves it to Open.
- Edit opens the Edit risk dialog to change the Heading, Priority, Status (Triage, Open, In Progress, In Review, or Closed), or Assignee. Workspace admins can also invite a new user by email from the Assignee picker. Save persists; Cancel abandons the changes.
- Archive / Restore: set the risk aside (it stays in the list, greyed out and sorted last), or bring an archived risk back.
Risk Tab
The Risk tab holds the score headline, the Model health card, the Details card (status, assets, ownership), the Risk model card, the Evidence card, a Related glance strip, and Comments.
Status
All risks start in Triage regardless of type. From Triage, Accept (header button) moves the risk to Open; Archive sets it aside without deleting it.
Once open, risks advance through Open → In Progress → In Review → Closed. Change the status from the Edit risk dialog’s Status dropdown, or from the list’s right-click context menu (Change status).
Archive is available from any state, not just Triage — archiving a risk that is already Open or beyond moves it out of the active view in one step without changing its lifecycle status. When archiving from the list’s context menu you may optionally enter a Reason (optional); it is saved as a comment on the risk and logged in the Activity tab. The Archive dialog on the Risk Details page has no reason field.
Archived risks
If a risk is archived, a warning Archived chip appears in the Risk Details header and a Restore button replaces Archive. Archived risks are always shown on the list, greyed out and sorted last. Bring one back with Restore on Risk Details, or Unarchive in the list’s right-click context menu.
Deleting a risk
Archived risks may be permanently deleted if your role includes the deleteRMRisks permission. The Delete permanently option appears in the right-click context menu on the risks list — only when the risk is archived. This is intentionally high-friction: archive first (reversible), then delete (irreversible).
Deleting a risk removes it and all associated data — comments, asset links, revisions, stages, controls, custom field values, keywords, attachments, attack paths, damage scenarios, and any CSI links.
Assets
A risk is linked to one or more Assets, each shown as a chip — the primary asset (chosen at creation) is highlighted and cannot be detached; any additional linked assets show in a secondary color.
Click Manage assets on the Details card to attach or detach assets from this page. The picker supports the same list/tree views, type/property filters, and primary-asset badge as attaching assets from the Risk Manager table’s right-click menu. A risk must always keep at least one asset — if you uncheck every asset, or a detach would leave none, that removal is rejected and the rest of your changes are still applied.
Manage assets is disabled while a save is in progress or while the risk is archived (restore it first).
Ownership and treatment
The Details card shows the risk’s Priority (Unassigned, Low, Medium, High, Critical) and Treatment (how your team plans to handle the risk: Avoid, Reduce, Share, or Retain):
- Priority and Status are changed via the Edit dialog, or from the list’s right-click context menu.
- The assignee is set in the Edit dialog or from the list’s right-click context menu (Assign to…).
- Treatment is read-only here — it is set by applying an AI suggested action on the Context tab.
Scoring
Risk scores are derived automatically from the risk model and the evidence attached to the risk. The Risk score card shows two values:
- Inherent: the score before controls, combining the risk’s Impact and Likelihood.
- Residual (with controls): the score after the controls applied to this risk lower its Likelihood.
Both values are on a 1–5 scale. A risk that is missing an Impact or Likelihood input shows a warning naming what it still needs instead of a score.
Likelihood comes from the linked attack paths. A path with a direct Feasibility rating uses that rating, which overrides the total of its attack steps; otherwise its likelihood comes from the attack-potential points of its steps, and a path with no scored steps counts as High. A threat scenario that carries a Feasibility rating counts as one more path. The path with the highest likelihood band, the easiest one for an attacker, sets the risk’s Likelihood.
Impact comes from the worst impact rating across the linked damage scenarios.
When the risk model gives a dial no input, VSEC falls back to the highest CVSS score across the risk’s evidence. Each dial falls back on its own: CVSS sets Likelihood when there is no attack path or rated threat scenario, and sets Impact when there is no damage scenario.
Model Health
The Model health card shows whether the risk has all the inputs needed to produce a score:
| Chip | Meaning |
|---|---|
| Likelihood ✓ / Likelihood needed | Whether the risk has an input for the likelihood dial |
| Impact ✓ / Impact needed | Whether the risk has an input for the impact dial |
| Controls ✓ / No controls | Whether at least one control is applied (affects the residual score) |
The card’s subtitle reads Complete - both dials have input when a score can be derived, or Incomplete followed by what is still needed. It also shows the evidence count, the last scored date, and the last evidence date so you can spot stale scores at a glance.
Evidence
The Evidence card lists the source-tagged observations that feed the score. Add evidence opens an inline form; each item can also be edited or deleted. Fields:
| Field | Description |
|---|---|
| Source | Design, Test, Monitor, or Manual |
| Summary | Narrative description of the finding |
| CVSS score | 0–10; drives a dial when the risk model gives it no input (see Scoring) |
| Weakness state | Clause-8 state — Event, Weakness, Vulnerability, or Not Applicable. A rationale is required when marking evidence Not Applicable (ISO/SAE 21434 §8.5) |
| Reference (CVE / report id) | An external identifier |
| Attachments | Files attached to this specific evidence item — click Attach files on the add/edit form. Click an attached file to open it, or remove it with its chip’s delete icon |
Adding, editing, or removing evidence re-scores the risk immediately. If the risk has no origin yet, the first evidence item’s source becomes its origin — see Risk Origins.
Risk model
The Risk model card groups the threat scenarios, attack paths, damage scenarios, and controls that drive this risk’s score, and attaches or detaches them:
- Threat scenarios: the Threat Library scenario this risk represents.
- Attack paths: drive Likelihood. The easiest linked path sets the attack feasibility (see Scoring).
- Damage scenarios: drive Impact. The worst impact category across linked scenarios sets the impact rating.
A risk keeps its own copy of each library entry it links, taken when the entry is attached, and scores from that copy. Editing an entry in the library, from any tool, never re-scores a risk on its own. When a linked entry has changed since the risk took it, the entry shows what changed and VSEC’s view of whether the change applies to this risk. Take the change updates the risk’s copy and re-scores it; Keep ours keeps the risk as it is. Either choice appears on the risk’s Activity tab as a Library change entry, naming the library entry, its revision, and the fields that were taken or declined.
Controls
The Controls section of the Risk model card applies Control Library entries to the risk. Linked controls reduce the residual score, and the risk re-scores live as controls are applied or removed.
Comments
The Comments section accepts text comments and is visible at the bottom of the Risk tab. To attach files to a risk, use the Context tab — uploaded documents become part of the risk’s context.
Related Tab
Risk relations help VSEC understand each risk better: when it builds a risk’s context, it reads the related risks and how they were handled. There are three relations:
| Relation | Meaning | What VSEC does with it |
|---|---|---|
| Same cause | The same weakness, e.g. one supplier ECU used in several programs. | Applies what was learned or decided on one risk to the other. |
| Fixes / Fixed by | Treating one risk resolves or reduces the other. | Reads the fixing risk’s controls and status when it curates the fixed risk. |
| Leads to / Follows from | Exploiting one risk opens the way to the other, as steps of one attack. | Reads the earlier risk’s likelihood when it curates the later one. |
When a risk’s status or treatment changes, VSEC updates the context of its same-cause risks and of the risks it fixes or leads to.
The tab lists two groups:
- Added: related risks someone added.
- Found by VSEC: risks that share something with this one, and the relation each one likely is. A shared CVE, Threat Library entry, control, keyword or similar heading suggests same cause; a risk on a parent or child asset suggests leads to or follows from. Risks that share only an asset or a damage scenario have no suggestion. Closed and archived risks are included.
To add a related risk, click Add related risk, choose how this risk relates to the other, and find the other risk by id or heading. A note is optional. To add a found risk, click Add on its row; the suggested relation is preselected. Use the pencil to change a relation or its note, and the trash icon to remove it.
To put a related risk in the PDF report, click its flag. Flagged relations appear in both risks’ report entries; new ones start unflagged.
Adding, removing and flagging require the updateRMRisks permission, and are recorded in the Activity log of both risks.
Filter the list with the search box, the Added and Found by VSEC toggles, and Type.
The Risk tab shows a one-line summary of related risks; View opens this tab.
Context Tab
The Context tab maintains a living AI-curated understanding of the risk, proposes field updates for human review, and surfaces Suggested actions — structured one-click state transitions. See Risk Context for the full workflow.
Activity
Per-risk change log. An entry is created whenever a field is edited, status changes (accepted, archived, restored), or a file is attached. Comments do not create Activity entries (an archive Reason is logged as part of its archive entry).
Filtering
The filter bar above the log lets you narrow history by any combination of:
| Filter | Description |
|---|---|
| Date range | From all time, Last 7 days, Last 30 days, Last year, or Between dates, which adds From and To fields. |
| User | Show only entries by a specific user (or System for automated actions). Options are derived from the users present in the currently loaded entries. |
| Action | Show only entries of a specific action type. Options are derived from the action types present in the currently loaded entries. |
Date range reloads the log for the chosen range; User and Action filter the loaded entries. All filters can be combined. Click Clear all filters to reset them at once.
If the filtered result is empty, the log displays “No activity matches your filter.”
If your workspace supports revision comparison, open an entry to compare it side by side with the previous version.