A risk register that does something.
Score risks on likelihood and impact, link each one to the controls and evidence that address it, and turn treatment into tasks with owners and due dates. Not a spreadsheet that goes stale between audits.
Risk register · Likelihood × impact · Framework assessments · Mitigation tasks
What is cyber risk management software?
Cyber risk management software is the system of record for the risks your organisation has accepted, is treating, or has not yet decided about. It holds the risk register itself, scores each risk consistently so risks can be ranked against one another, records the controls that address them and the evidence those controls are working, and tracks the mitigation work through to closure. The version most teams have is a spreadsheet that is accurate the week it is written and misleading by the next quarter, because nothing in it is connected to the controls, policies, or findings that would keep it current. Sable keeps the register in the same workspace as those things, so a risk moves when the program moves.
From a list of worries to a program of work.
The register, the scoring, the controls behind it, and the treatment that closes it out.
A live risk register
Every risk in one register with an owner, a score, a treatment decision, and a current status, rather than three spreadsheets that disagree.
Likelihood × impact scoring
Score consistently on likelihood and impact so risks rank against each other, and the ranking survives a change of analyst.
Framework assessments
Run assessments against SOC 2, ISO 27001:2022, CMMC, HIPAA, and GDPR, with more frameworks in flight, and let the gaps they surface feed the register.
Controls linked to evidence
Each control links to the evidence and policies behind it, so 'this risk is mitigated' is a claim you can open rather than one you have to trust.
Mitigation tasks that land on someone
Treatment becomes a task with an owner and a due date, tracked to closure, which is the difference between managing risk and cataloguing it.
Reporting and export
A current view for the board and an exportable register for the auditor, generated from the live data instead of rebuilt each cycle.
Risk that connects to the work.
A risk in Sable carries its score, its owner, the controls that address it, the evidence behind those controls, and the open tasks that will close it. Change a control and every risk that depends on it reflects the change, including the version in your board report.
- 2 tasks · R. GuptaUnmanaged admin access in prodHigh · L×I 16
- 1 task · J. PriceVendor holds PII without a DPAHigh · L×I 12
- 1 task · K. ScheweNo tested restore for the CRMMedium · L×I 9
- AcceptedLegacy VPN still reachableLow · L×I 4
Risk scored by people who run the attacks.
One register, one program
A standalone risk tool gives you a register that nothing else updates. In Sable the register sits alongside your controls, policies, vendors, and findings, so it moves when they move rather than at audit time.
Graded against what actually happens
SubRosa is an offensive security firm. We spend our week proving which risks are reachable and which are theoretical, and that judgement is what the register is built to hold.
Live in the trial, not after a rollout
Risk and controls tracking is included from the Team plan and available in the free trial. Import your register, score it, and assign the first mitigation the same day.
Stop keeping risk in a spreadsheet.
Start a free trial of Sable and turn your risk register into something that ranks, connects, and closes.
Common questions
- What is cyber risk management software?
- Cyber risk management software is the system of record for the risks an organisation has accepted, is treating, or has not yet decided about. It holds the risk register, scores each risk consistently so risks can be ranked against one another, records the controls that address them and the evidence those controls are working, and tracks mitigation through to closure. It replaces the spreadsheet register that is accurate the week it is written and misleading by the next quarter.
- What is a risk register and what should it contain?
- A risk register is the list of identified risks together with everything needed to act on them: a description specific enough to be actionable, an owner, a likelihood and impact score, the treatment decision (accept, mitigate, transfer, or avoid), the controls addressing it, and the current status. A register without owners and treatment decisions is an inventory of worries rather than a management tool, which is the most common failure we see when we assess one.
- Does Sable do cyber risk quantification?
- Not in the FAIR sense, and we would rather say so than blur the term. Cyber risk quantification usually means modelling risk in monetary terms — expected annual loss, loss exceedance curves — using a method like FAIR. Sable scores risks on likelihood and impact, which ranks risks consistently against each other and drives treatment decisions, but does not produce a dollar figure. If a board mandate specifically requires monetary quantification, you need a dedicated CRQ tool alongside your register, and we will tell you that on a call rather than after you have bought.
- Is this continuous control monitoring?
- Partly, and it is worth being precise about which part. In Sable each control links to the evidence and policies behind it, and vulnerability scanning runs continuously and feeds findings into the same workspace, so control state is visible rather than reconstructed at audit time. What Sable does not do is automatically test every control against a live integration on a fixed cadence, which is what the phrase 'continuous control monitoring' means to some vendors. Evidence collection for those controls is a task with an owner, not an automated probe.
- Which frameworks can I assess against in Sable?
- SOC 2, ISO 27001:2022, CMMC, HIPAA, and GDPR ship today, with further frameworks in flight. Assessments run against the same control set your risks and policies are linked to, so a gap surfaced by an assessment becomes a risk in the register and a task for an owner without anyone re-keying it into a second system.
- Is risk management included in the Sable free trial?
- Yes. Risk and controls tracking is included from the Team plan and is available in the 14-day free trial with no credit card. You can import an existing register, score it, and assign the first mitigation task the same day.