Meet us at the Startup area, and at our workshop on Wednesday 7 October, 4:30 pm. Grimaldi Forum, a ten-minute pitch.
Book the workshopOur Assises workshopBY ROLE · RISK MANAGER
Your committee arbitrates between risks it can compare, and cyber arrives as a colour on a slide, scored by a method nobody outside security can explain. Mindlapse gives the cyber line the same discipline as the others: explicit scoring, appetite, owners, reviews.
Inherent · Residual · Target · One appetite, one escalation path
The residual-to-target gap is the commitment the committee arbitrates.
THE SITUATION
“High” means whatever the last analyst meant; the committee cannot set it beside the fraud line.
The board signed a tolerance statement; nothing tells you the day it is breached.
The EBIOS session produced a deck, not a register that changes when a control fails.
One provider under four business lines, visible only on the day it goes down.
WHAT MINDLAPSE CHANGES
Surface: Risk Analysis
Inherent, residual and target on every risk, each with its likelihood, impact and band, on NIST, ISO/IEC 27005 or EBIOS RM scales set per organization; the residual-to-target gap is the treatment commitment.
Learn more
Surface: Risk Posture
Appetite statements with approval, expiry and breach alerts; when a line is breached, the owner is alerted and an acceptance request opens, escalated to the authority its residual band requires.
Learn more
Surface: Business Impact Analysis
Each cyber risk lands on the business activity it threatens, with that activity’s criticality, loss horizons and recovery objectives, so the impact score has a business anchor the committee recognises.
Learn more
Surface: Dependency map
Suppliers sit on the activities they run or host; one provider under several critical activities is flagged where it would hurt, before the outage makes it visible.
Learn more
Surface: Organization Map
Entities keep their scales, inherited from the group; the consolidated line states its aggregation, equal or weighted, and drills down to the risks behind it.
Learn more
YOUR WEEK, YOUR QUARTER
A risk line earns trust by being re-scored, re-reviewed and re-accepted on a schedule the committee can see.
Your week
MON 09:00
Three reviews fell due while you were away.
They surfaced on their own, each with its owner and its last score.
Surface: Risk Register
TUE 11:20
Ernest proposed a likelihood you did not agree with.
The analyst rejected it with the weighted factors on screen and re-scored; the record kept the provenance, human, AI-suggested or hybrid.
Surface: Risk Analysis
WED 15:00
A supplier’s answer contradicted a control it had declared.
A finding was raised into the queue, linked to the risk that depends on that supplier.
Surface: Action queue
alert: THU 08:30
The payments line crossed its appetite.
The alert reached the owner and an acceptance request opened on its own, escalated to the authority its residual band requires.
Surface: Risk Posture
verified: FRI 16:00
The committee wants the trend, not a point.
The KRI trend was read from the daily snapshots, no series rebuilt by hand.
Surface: Risk Posture
Your quarter
WEEK 4
A new activity enters the scope.
Five guided EBIOS RM workshops, the scenarios straight into the register.
Surface: Risk Analysis
WEEK 9
The acceptance requests.
Escalated by residual band, the required authority frozen at submission, each one time-bound.
Surface: Risk Posture
WEEK 12
The committee review.
Every cyber line with its owner, its last review and its residual-to-target gap.
Surface: Risk Register
Illustrative week: the moments are fictional, the surfaces are the product’s.
FROM THE FIELD
CYBER COLLECTIVE LAB · Edition 2
Concentration as a risk-committee topic: the edition on third-party risk in the strategic chemicals sector, where one provider under several business lines stopped being a procurement detail.
Measured with our design-partner CISOs, figures under continuous validation.
UNDER THE HOOD
FAQ
No. Mindlapse works in scores, bands and commitments: likelihood times impact on the scales you govern, inherent, residual and target on every risk. The value chain carries a criticality and an estimated-impact field on each activity, never a euro figure, and no FAIR or Monte-Carlo model runs behind the score.
Not through a connector today: there is no ERM integration in the catalog. What you get is a line built to be comparable: the scoring model is explicit, the scales are yours, and board packs export in PDF or PowerPoint for the committee file.
NIST 5×5 as the baseline, ISO/IEC 27005, and EBIOS Risk Manager run as five guided workshops, from framing to treatment. Scales and matrices are configured per organization, with inheritance, so an entity can keep its scale and the group still compares.
It never rewrites the score by itself. A deteriorating rating fires the re-assessment trigger; a contradiction in the supplier’s answers raises a finding on the risk linked to that supplier; the score changes when you re-score, and the record shows why.
No. Ernest proposes a likelihood, a scenario or a treatment with its confidence level; accepting or rejecting is an explicit act, recorded with its author, and every risk keeps its provenance: human, AI-suggested or hybrid.
Read it next
The register of information as living data, concentration on the chain, one control set for DORA and NIS2.
Learn more
Contractors graded like the systems they touch, one posture per entity, exceptions tied to the outage window.
Learn more
Plants as entities, products under the CRA, OEM questionnaires answered from the atlas.
Learn more
Also by outcome
ONE REGISTER, VERIFIED
A live session on your method: scales, matrix, appetite, escalation.
Our host’s audience measurement (Vercel) uses no cookies and is not covered by this choice. Google Analytics and marketing trackers stay off until you say otherwise. Read the cookie policy