Evidence Freshness Decay Engine:
Evidence confidence decays on a ~28.9-day half-life from upload. A verified cloud webhook event naming the control resets the clock without a re-upload.
FAIR Monte Carlo Financial Loss Simulator:
A 10,000-iteration Monte Carlo simulation over your own frequency/magnitude estimates, with cited GDPR & NIS2 statutory ceilings shown alongside it.
Statutory Incident Reporting Register:
Log one incident and see every statutory reporting clock it triggers across NIS2, the UK and Irish NIS Regulations, CER, DORA and the GDPR in both its EU and retained UK forms — resolved from your jurisdiction and your own scope selections, each deadline cited to its provision. Manual entry — no automated CSIRT filing.
Third-Party Vendor Registry:
A flat registry of the vendors you add, with criticality and compliance status. Not a recursive sub-processor or 4th-party dependency graph.
HMAC-SHA256 Report & Evidence Chain:
A tamper-evident linear chain covering report exports, evidence uploads/reviews, and now authenticated cloud telemetry events — one chain per tenant.
Remediation Spend Optimizer:
An exact 0/1 knapsack, solved via bounded dynamic programming (not a greedy approximation), over your open gaps and budget.
CRA Article 14 Reporting Register:
A private 24h/72h/final-report clock for actively exploited vulnerabilities and severe incidents in products you place on the EU market. Files nothing — no ENISA connection, no Single Reporting Platform integration, no automated submission. Shown only if you declare yourself a CRA manufacturer. All six stage timings are verified against the Official Journal text of 20.11.2024.
DORA Register of Information Export:
Exports 4 of the register's 15 templates as plain CSV from your vendor registry. A data-preparation aid — not xBRL-CSV, not validated against the EBA taxonomy, not filable with the Central Bank of Ireland. All 45 column codes are verified against Annex I as corrected by the 19.9.2025 corrigendum, and against the EBA XBRL 4.0 taxonomy.
Risk Prioritization & ROI Agent:
AI-assisted executive narrative over a real, already-solved ENG-09 remediation allocation. Never computes a euro figure or score of its own — it only narrates numbers you already computed. Shows nothing until you solve a real allocation.
Incident Reporting Agent:
AI-assisted briefing over your real open incidents (ENG-06), referenced against the notification windows of the regime your own jurisdiction is under — the NIS Regulations 2018 (S.I. No. 360/2018) in Ireland, NIS2 Article 23 as transposed in the rest of the EU, the NIS Regulations 2018 (S.I. 2018/506) in the UK — timing information only, never a compliance verdict. Shows nothing when there are no open incidents.
Supply Chain Concentration Agent:
AI-assisted narrative over your real Third-Party Vendor Registry (ENG-07): category concentration and data-access exposure computed from fields you entered. Never an automated sub-processor discovery — there is no real data source for that. Shows nothing until you have a vendor on file.
Vulnerability Triage Agent:
AI-assisted patching-priority briefing over your real, manually-logged vulnerabilities, sorted by real CVSS score and affected-asset count. No scan-feed ingestion, no asset-criticality correlation and no financial-exposure figure — none of those data sources exist yet. Shows nothing until you have a vulnerability on file.
Pricing information for Vivid Risk is supplied by the software provider or retrieved from publicly
accessible pricing materials. Final cost negotiations to purchase Vivid Risk must be conducted with the
seller.
Pricing information was last updated on October 22, 2026
