GRC platform for comprehensive ICT risk management — from risk identification and assessment, through control registers and treatment plans, to regulatory reporting. On-premises. Full data control.
Trusted by financial
sector institutions
Beyond the classic heat map, RISKBOW offers a unique quantitative approach — automatically analyzing dependencies between ICT assets and calculating risk scores that account for threat propagation. Result: precise KRI instead of subjective estimates.
5-stage algorithm calculating risk score per ICT asset accounting for dependencies and threat propagation. AI prediction.
Quantitative Risk Scoring
Built-in support for DORA, KNF (SPRPF-18/20/26/27), ISO 27001, NIS2. Multi-entity and reporting.
Full data control. Deployment on your infrastructure: Kubernetes, VMware, bare metal. No vendor lock-in.
KRI automatically updated on every data change. Real-time alerting and escalation — not nightly batch.
Interface designed for risk analysts, CISOs, and compliance officers. Responsive dashboards, interactive graphs.
Last update: 22.04.2026 14:32 · Company A
| Asset | Score | Status |
|---|---|---|
| srv-prod-db-01 | 34.2 | Critical |
| app-payment-gw | 61.5 | Warning |
| net-fw-core-02 | 91.7 | OK |
| cloud-s3-backup | 72.0 | Warning |
| ID | Risk | Level | Status |
|---|---|---|---|
| R-2026-001 | Payment system business continuity loss | Critical | In Progress |
| R-2026-014 | Unauthorized access to personal data | Critical | Accepted |
| R-2026-027 | Cloud supplier concentration risk | High | New |
| R-2026-033 | Missing current BCPs for critical processes | High | In Progress |
| R-2026-041 | CIS Benchmark configuration non-compliance | Medium | New |
| Contract No. | Supplier | Validity |
|---|---|---|
| ICT/2025/0142 | Dostawca A | 31.12.2027 |
| ICT/2024/0089 | Dostawca B | 30.06.2027 |
| ICT/2025/0201 | Dostawca C | 31.03.2026 |
| ICT/2025/0178 | Dostawca D | 31.12.2026 |
Interactive interface preview · Request demo to see the system live
Collecting data from 7 sources: vulnerabilities, incidents, regulatory issues, CIS audits, missing support and more
Converting raw risk to normalized risk score (0–100) accounting for risk tolerance per asset
Automatic risk spreading through the network of ICT asset dependencies
Detecting the most critical failure points — assets whose risk affects the entire organization
Resulting KRI indicator per ICT asset — accounting for all risk sources and dependencies
The RISKBOW risk assessment engine automatically calculates KRI (Key Risk Indicators) per ICT asset, considering the entire dependency network. It propagates threats, identifies single points of failure, and predicts trends using AI.
Quantitative and qualitative risk assessment with automatic propagation through dependency graphs. Heat map + quantitative risk score. Risk appetite and risk tolerance definition per entity.
Central risk register with inherent and residual risk breakdown. Risk self-assessment, approval workflow, multi-entity support. Cyber threat and scenario database.
Security control library mapped to risks and regulatory requirements. Control effectiveness testing, gaps, and remediation plans.
Registration, classification and handling of ICT incidents per DORA Art. 17–23. Regulator notification, root cause analysis, lessons learned.
BIA (MTPD/RTO/RPO) with automatic propagation. BCP and DRP builder, continuity testing, MAC per critical process.
Third-Party Risk Management — due diligence, audit surveys, concentration risk algorithm. SLA monitoring and exit plans.
Contractual provisions register with automatic SPRPF-18/20 report generation and SPRPF-26/27 filters required by KNF.
Report builder, PDF/XLSX/CSV export. Role-based dashboards with real-time KRI. Reports for 1st, 2nd, and 3rd Line of Defense.
Connect source systems — CMDB, vulnerability scanners, asset registries. Import XML/XLSX/CSV, SOAP/REST, ETL.
The engine automatically calculates KRI per ICT asset with propagation through dependency graphs. AI predicts risk trends.
Make risk decisions, monitor remediation plans, report to regulators. Full process accountability.
Built on proven enterprise technologies. Compatible with financial institution infrastructure. Open architecture — parameterizable algorithms, rules, and dictionaries.
+-----------------------------+ | Angular 19 (Frontend) | | D3.js · Vis.js · Tailwind | +--------------+--------------+ | REST / SSE +--------------+--------------+ | Spring Boot 3.4 (Backend) | | Java 21 · Security · Camel | +--------+-----------+--------+ | STOMP | JDBC +--------+---+ +----+--------+ | ICS Python | | PostgreSQL | | Flask · ML | | SCD1 · SCD2 | +------------+ +-------------+
RISKBOW supports key risk management and information security standards — ready-made mappings, report templates, and compliance controls.
EU Regulation 2022/2554
Full support for Digital Operational Resilience Act requirements — ICT risk management, incidents, testing, critical suppliers.
+ ISO 27005 Risk Management
Annex A control mapping, ISO 27005-compliant risk assessment, Statement of Applicability (SoA), and risk treatment plan.
EU Directive 2022/2555
Support for NIS2 cybersecurity requirements — risk management, incident reporting, supply chain security.
ICT Contract Information Register
Automatic generation of SPRPF-18, SPRPF-20 registers and SPRPF-26/27 filters required by KNF for the financial sector.
Enterprise Risk Management
Process structure aligned with COSO ERM — from governance and risk culture, through strategy, to monitoring and continuous improvement.
Risk Management Guidelines
The risk management process in RISKBOW follows the ISO 31000 cycle — identification, analysis, evaluation, treatment, monitoring, and review.
RISKBOW supports financial, insurance, and other regulated entities in ICT risk management, compliance, and operational resilience.
Life and non-life insurance, reinsurance. Multi-entity, SPRPF-18/20/26/27, ICT contract register, KNF and EIOPA reporting.
Commercial and cooperative banks, payment institutions. Full DORA support, EBA guidelines, core banking system integration.
Investment funds, leasing companies, brokerage houses. Supplier risk management, critical process BIA, ICT dependency mapping.
Energy, telecommunications, critical infrastructure. NIS2 compliance, ISO 27001, operational risk and business continuity management.
No hidden costs. Per named user license + annual support subscription.
Basic ICT risk management
Full regulatory compliance + BCM
Full platform + ML + customization
Schedule a free demo and see how RISKBOW propagates threats through your ICT asset dependency graph.