What Riskonami is

Riskonami helps you produce a defensible risk picture for one named system: what can go wrong, how bad it would be, what you already do, what residual risk remains, and what you will treat or transfer. It is not a chatbot. You answer questions, review tables, and confirm work. The server owns the phase sequence, the scores, and when a phase is complete. This page is for deciding whether the product fits. To run it, start at Getting started.

What you should expect

You assess one system (or a tightly bound process) at a time. A typical walk:

1. You describe the organisation, the system, and impact (confidentiality, integrity, availability).
2. You model where the system runs, who owns which parts, and which suppliers sit on the boundary.
3. The server derives control points, threats, and risk scores from that model and from method packs (including ISO/IEC 27002).
4. You decide what to accept, mitigate, or transfer.
5. You issue named reports from one snapshot — not a second assessment.

You can complete that walk without AI. Optional AI only drafts or proposes; you still review.

What you produce

Download	Who it is for
Executive	Leadership: organisational residual, appetite, material risks
Engineering	Builders: architecture, threats, the risk register, remediation
Control register	Governance: every in-scope ISO control, including vendor-held rows under the vendor’s name
Overall risk	Risk owner: combined residual, including accepted vendor answers
Overall compliance	Compliance: combined control status, including accepted vendor compliance
Vendor control assessment	One file per named supplier: their controls and transferred work

Accepted vendor answers are included in the overall risk and overall compliance reports. Until you accept them, those controls stay unknown. Details and sample PDFs: What you get.

Why organisations commission this

Boards, CISOs, and auditors need more than a control checklist. They need a traceable answer they can put in ISMS records, treatment plans, and customer due diligence. Riskonami does not certify you to ISO 27001. It helps you do the risk work those programmes require.

IRAM 2.0 and other frameworks

IRAM 2.0 is the method: threat-oriented analysis, CIA impact, likelihood given controls, residual after treatment, documented decisions. Other catalogues plug into that chain. They do not replace it.

Framework	Role
IRAM 2.0	How the assessment is structured and scored
ISO/IEC 27001	The ISMS reason to run a defensible assessment
ISO/IEC 27002	Control vocabulary used inside the assessment
Your own / best-practice controls	First-class alongside ISO, still in the same walk
NIST CSF 2.0	Stakeholder language; not a CSF-first product

AI in one paragraph

When you turn AI on, Riskonami may run a small set of named calls (context from your words and files, diagram reading, control proposals, optional report narrative). The model cannot invent the next phase, set a score, turn missing evidence into “safe”, or formally accept risk. Full page: AI: what it does and does not do. Pre-sales depth: Assurance.

Cost in one paragraph

The guided process is free. You pay when a named AI call actually runs (1 token per call), or for optional expert validation. Download what you need: server copies are not kept forever. Tokens and billing. Next: What you get · Getting started · How it works