The problems this exists to solve.
Built for enterprise AI.
How it works for your team, day to day.
Scores built from behavior, not vibes
Risk combines what a tool is (vendor posture from the catalog) with how it's actually used in your organization: which data classes it touches, how many users, what departments, what the enforcement history looks like. Two companies using the same tool can (correctly) score it differently.
Dynamic by default
Scores move as reality moves: a tool that starts touching customer PII climbs, a retired tool decays, an agent that trips policy repeatedly gets hotter. Prioritization stays honest without anyone re-running a review.
Every score decomposes
Click any score and it splits into its factors (the data classes involved, the usage volume, the vendor posture inputs) so the conversation with a skeptical stakeholder is about evidence, and the artifact you show an auditor explains itself.
The questions we hear most.
Can we tune the scoring model?
Weights are adjustable, a healthcare deployment can weight PHI exposure higher than a fintech weights source code, and the decomposition shows the effect.
Can policies key off scores?
Yes. Thresholds drive policy, so tools crossing a risk line automatically pick up stricter rules pending review.
How are false signals handled?
Factors are visible and correctable: misclassified usage can be recategorized, and the score recomputes with the correction logged.
Does scoring cover agents too?
Yes. Agents score on the same dimensions plus action patterns: tool scopes used, destinations reached, and enforcement history.