Scale Your Compliance
with Confidence
From boutique startups to global enterprises, we provide the technical assurance you need to navigate NIS2, DORA, NIST CSF 2.0, and ISO 27001.
See your score before you pay
Create a free account and answer the full assessment. You see your Vivid Maturity Index, your maturity tier and how many findings you have at each priority. The findings themselves, their citations, the report and the certificate unlock with the Assessment (€749, one-time), and your answers carry over.
Try the assessment freeAlready bought the Assessment? Try the Compliance Workspace
Every Assessment customer can try the Compliance Workspace free for 14 days, once, with no card. Afterwards you are back on your Assessment with nothing taken away; start it from your dashboard.
Every plan is priced per organisation: one workspace covers all of its branches and sites, with no per-branch or per-member fees.
Assessment
One-time — no recurring charge
One complete, framework-mapped self-assessment with a full gap analysis — for organizations that need a rigorous baseline, not a subscription.
ForOrganizations that need one thorough, defensible self-assessment ahead of an ISO 27001, NIS2, or DORA review.
- Full self-assessment scored on the Vivid Maturity Index (ENG-01)
- Controls cited to 7 frameworks, each checked against its primary text
- ‘Start here’ — the report’s ranked top ten fixes
- ‘Which rules apply?’ — a scope check on your answers, not a legal ruling
- DORA-led report view, if DORA reaches you
All 16 capabilities, with their limits
- A complete self-assessment scored on the Vivid Maturity Index (ENG-01), with a findings report and prioritised roadmap — 1 on Assessment, unlimited from Compliance Workspace
- Controls cited, where they apply to your jurisdiction and scope, to NIS2, ISO/IEC 27001:2022, DORA, NIST CSF 2.0, NCSC Cyber Assessment Framework v4.0, GDPR, UK operational resilience — each citation checked against its primary text
- 'Start here': the report's ranked top ten — reporting deadlines first, then severe gaps, then the score each fix recovers — each with a suggested action and its priority
- 'Which rules apply?': a scope check against NIS2, DORA, GDPR and the UK and Irish NIS Regulations, on your own answers — it reads your answers; it does not decide your legal status
- A DORA-led report view for organisations under DORA, citing the Regulation and its RTS on ICT risk management — it adds DORA's own questions only if DORA reaches you. Shown only if DORA reaches you or you select DORA oversight.
- Secure-development questions (coding standards, environment separation, security testing, source-code access, outsourced development) for organisations that build or commission software. Asked only if you tell us you build or commission software.
- UK operational resilience questions for firms that select them, each cited to the FCA Handbook's SYSC 15A or the PRA Rulebook — a self-assessment: Vivid Risk files nothing and decides nothing. Asked only if you select UK operational resilience, which is offered to UK organisations only.
- CyFun readiness for EU organisations, mapped from your answers — our mapping, not the CCB's
- 3 read-only Google Workspace, Microsoft 365, Microsoft Azure connections that show counts (e.g. MFA enrolment) beside the answer you give — a connection never answers a control
- PDF export with the report linked into your tamper-evident record (ENG-08), a standalone Cryptographic Proof Bundle Export (JSON) of that chain, and a certificate when your score reaches 90 with no severe gap left open
- Evidence uploads — 25 files on Assessment, unlimited from Compliance Workspace; up to 25 MB each
- Executive views and score history as findings are resolved
- Audit-Readiness Agent (Vigilance-1, AGT-01) — an AI-generated narrative summary of your findings, on request, on top of the full report
- Evidence freshness decay engine (ENG-02) — ~0.1%/hr exponential decay, 28.9-day half-life
- Tenant-scoped HMAC-SHA256 report & evidence chain (ENG-08) — tamper-evident linear chain, not a Merkle tree
- ISO/IEC 27001 audit-ready pack — all 93 Annex A controls listed, with your own answers for the 63 the assessment covers (68 if software development is in scope) and the 25 no question covers marked not covered; your evidence index and, from Compliance Workspace, your technical-controls registers, as one download for your certification body; recorded by you, it is not a certificate, an audit opinion or a Statement of Applicability
Gain a rigorous, framework-mapped self-assessment with AI-augmented findings and a thorough gap analysis you can act on immediately.
Compliance Workspace
or €4,968/yr billed annually (~17% off)
Billed annually at €4,968/yr (~17% off)
Ongoing compliance work: unlimited re-assessments, AI-assisted cross-mapping, an unlimited incident register, and a vendor registry.
ForSMEs and scale-ups with ongoing NIS2, DORA & ISO 27001 compliance work and evolving tech stacks.
- Everything in Assessment (Tier 1)
- Unlimited re-assessments
- AI-augmented cross-mapping (ENG-04)
- Incident register with reporting clocks (ENG-06) — it files nothing
- DORA Annex I report sheet, pre-filled from the register — preparation, not a submission
All 33 capabilities, with their limits
- Unlimited re-assessments
- AI-augmented cross-mapping (ENG-04)
- Incident register with reporting clocks for NIS2 Article 23, CER Article 15, UK NIS Regulations 2018, CRA Article 14, GDPR Article 33, UK GDPR Article 33, DORA Article 19, Ireland NIS Regulations 2018, AI Act Article 73; FCA and PRA incident reports for UK financial firms (each clock applies from 18 March 2027) (ENG-06) — it records what you file; it files nothing
- DORA major-incident report preparation: the Implementing Regulation (EU) 2025/302 Annex I template, pre-filled from your incident register where the register holds the same fact, with every field Annex II marks mandatory counted. You check it and submit it through your competent authority’s own channel — it files nothing, and its CSV is a preparation sheet, not checked against any authority’s file format. Shown on an incident only if you select DORA oversight.
- Cyber Threat Register for significant cyber threats (NIS2 Art. 23(2), DORA Art. 19(2)–(3)) — no clock, and it notifies nobody
- Risk register: likelihood × impact on a 5×5 heatmap, treatments, a risk appetite, and a reason recorded with every acceptance or closure. The ratings, including residual, are the ones you enter; it does not answer or change your assessment
- Control ownership: who is Accountable, Responsible, Consulted and Informed for each of the 145 controls, as roles you name. Consulted and Informed are labels; no one is notified. It does not answer a control or change your assessment
- Findings register: findings from an audit, a test, an incident or a review, the corrective actions that fix them, and a reason recorded with every acceptance or closure. It runs no test and no one is notified; it does not answer a control or change your assessment
- Control testing: the result of a test of a control's design or operating effectiveness, how it was tested and what was concluded, with a correction that supersedes an earlier test. It runs no test and no one is notified; it does not answer a control or change your assessment
- Policy register: your policies, each with versions you record, the controls it supports and a review date, and a reason recorded with every decision: approval, review, retirement or reinstatement. It writes or enforces no policy and no one is notified; it does not answer a control or change your assessment
- Decision log: the board and committee meetings you record and the decisions taken at each, with a reason and a link to the risks, findings, policies and controls they concern. A final meeting cannot be changed, and a correction is recorded as a new decision. It takes or checks no decision and no one is notified; it does not answer a control or change your assessment
- Patch register: the patches you record against your assets, planned, applied, failed or rolled back, with the vulnerabilities each addresses and who applied it and when. It applies no patch, scans nothing and no one is notified; it changes an asset or vulnerability only when you choose to, and a patch does not answer a control or change your assessment
- Processing inventory: the record of processing activities you keep under Article 30 of the GDPR or UK GDPR, as controller or processor, each field citing its point, linked to the suppliers and assets it names. You type every entry; Vivid Risk decides nothing about whether your processing is lawful or whether Article 30(5) applies, sends the record to no one, and it does not answer a control or change your assessment
- DPIA register: the data protection impact assessments you keep under Article 35 of the GDPR or UK GDPR, from the screening you record to the Article 35(7) assessment, each heading citing its point, linked to the controller processing records and risks it names. You type every entry. Vivid Risk decides nothing about whether a DPIA is needed, whether high risk remains or whether you must consult your data protection authority, sends the record to no one, and it does not answer a control or change your assessment
- Issue log: the problems and concerns you record, each with a priority, an owner, a due date and a resolution, linked to the risks, controls and a finding it concerns, with the log as CSV and each issue as PDF. You type every entry. It notifies no one, sends nothing and changes no risk or finding; it does not answer a control or change your assessment
- Regulatory change log: the regulatory changes you record, each with the law, regulation or guidance you name, your summary of what changes, the effective date you enter, your impact rating, an owner and your assessment, linked to the controls, policies and risks it concerns, with the whole log as CSV and each entry as PDF. You type every entry. Vivid Risk fetches no source, supplies no entry or citation, notifies no one and changes no control, policy or risk; it does not answer a control or change your assessment
- UK financial records, for UK organisations: the firm profile you record for your FCA and PRA duties, each answer yours, including not sure; important business services and impact tolerances; FCA and PRA incident report packs and a material third-party register with Form M and annual register exports (FCA and PRA reporting applies from 18 March 2027); and mapping, testing, lessons learned, communications and retained self-assessment versions under SYSC 15A; and a Coverage tab of what you have recorded against those rules, which changes no result and is not a finding that you meet them. Vivid Risk decides nothing about which rules reach your firm and submits nothing to any regulator; the exports are a data-preparation aid, and it does not answer a control or change your assessment
- KRI register: the key risk indicators you choose, each with the amber and red thresholds you set and the readings you record, linked to the risks it names. You type every entry. Vivid Risk compares each reading with your thresholds, collects no figures, sends nothing and changes no risk; it does not answer a control or change your assessment
- Supplier assessments: a questionnaire for each supplier, with each built-in question showing the clause it was drawn from, that you export and send yourself, and the answers, outcome, residual risk and next review date you record. It sends nothing to your supplier and reads none of their systems; it changes a supplier record only when you choose to, and an assessment does not answer a control or change your assessment
- Vendor registry — capped at 35 records (ENG-07, flat registry, not a 4th-party graph)
- FAIR Monte Carlo loss simulation (10,000 iterations) + exact 0/1 knapsack remediation-spend optimizer (ENG-03 + ENG-09)
- Vulnerability Lifecycle Hub — findings logged by you or imported from your scanner's export (CSV, .nessus, SARIF, Trivy); it scans nothing. CVSS-sorted triage via Sherlock-6 (AGT-06)
- Security testing register — the penetration tests and exercises you commission or run, their findings counts, how many of the findings you linked in the Vulnerability Hub are still open, the retest date and the next test, recorded by you; Vivid Risk performs, arranges and verifies no test
- Security tools you run and the assets each covers, with the critical and high assets you have recorded no tool against — recorded by you; it detects nothing and checks no install
- Logging and retention register — where each system's logs are kept, for how long, who reviews them and the reviews they record; Vivid Risk collects, stores and reads no log
- Certifications register — the certificates and attestation reports you hold or are working towards (ISO/IEC 27001, Cyber Essentials, SOC 2 and others), who issued each, its number, scope, expiry and next audit, recorded by you; Vivid Risk certifies no one and verifies no certificate
- Essential services register — the business services you provide, their impact and the assets they depend on, recorded by you
- Asset registry — the systems you run, their criticality, the services they support and the software each runs with its end-of-support date, typed or imported from your own CSV; recorded by you, it discovers nothing and holds no end-of-life data
- 3 more AI narrative agents: risk prioritization (Sentinel-2), incidents (Guardian-3), vendors (Ecosystem-5)
- Continuity of Assurance: a tenant-authenticated webhook endpoint for GCP/Azure/AWS security telemetry — every accepted event is chained into your tamper-evident report/evidence record (ENG-08), and can reset a referenced control’s evidence freshness clock (ENG-02) without a manual re-upload
- CRA Article 14 reporting register (ENG-11) — a private 24h/72h/final-report clock for actively exploited vulnerabilities and severe incidents in products you place on the EU market. Shown only if you tell us you are a CRA manufacturer. It files nothing: no ENISA connection, no Single Reporting Platform integration, no automated submission
- DORA Register of Information (ENG-12) — exports 4 of the register’s 15 templates as plain CSV from your vendor registry. A data-preparation aid, not an xBRL-CSV submission, and not filable with the Central Bank of Ireland. Shown only if you select DORA oversight. Column codes follow Annex I as corrected by the 19.9.2025 corrigendum
- The EU AI Act workspace (ENG-05) can be added, priced separately by how many AI systems you record: a register of the AI systems you use, a classification path for each that shows what your answers indicate — the classification is yours — and the duties for your role, cited to the Act. It decides nothing, certifies nothing and files nothing
Compliance isn't a one-off. This plan adds unlimited re-assessments, AI-assisted cross-mapping, and vendor tracking to your Tier 1 baseline.
- Multi-Cloud Asset & Policy Ingestion (AWS/GCP/Azure)
Team
or €10,548/yr billed annually (20% off)
Billed annually at €10,548/yr (20% off)
Everything in Compliance Workspace, with the Strategic Posture view, an unlimited vendor registry and priority support.
ForRecommended for organisations with several branches or a bigger team, which tend to outgrow the 35-vendor registry of the Compliance Workspace; and for dedicated compliance staff with a growing third-party footprint.
- Everything in Compliance Workspace (Tier 2)
- Strategic Posture — an AI draft to review, with no access to your systems
- Vendor registry — unlimited
- Priority support (tickets routed High-priority)
- First access to new capabilities as they’re built and verified — never sold as included before they exist
All 4 capabilities, with their limits
- Strategic Posture view — a Gemini-assisted board-level risk pass over the profile you enter; AI-generated draft output to review before acting on it, with no connection to your systems
- Vendor registry — unlimited
- Priority support (tickets automatically routed High-priority)
- First access to new capabilities as they’re built and verified — never sold as included before they exist
Unlimited vendor tracking, priority support and the Strategic Posture view on top of the same engines every tier runs on — roadmap capabilities are clearly marked and never sold as included before they're built.
- DSA Compliance Agent — Archon-7 (AGT-07)
- Multi-Agent Coordinator — Synthesizer-8 (AGT-08)
- WebAssembly High-Density Graph Offload — 2,000-node Barnes-Hut SIMD (ENG-10)
- Multi-Cloud Asset & Policy Ingestion (AWS/GCP/Azure)
The AI Act, priced by how many AI systems you record
Start with the free snapshot, or take any pack with a 14-day free trial. The same price on its own or added to a Compliance Workspace or Team plan, monthly or yearly.
Free snapshot
No card · no time limit
Record one AI system, work out the rules for each and keep the records the Act asks for.
ForTrying the workspace on the one AI system that matters most. No card, no time limit.
- A register of your AI systems
- A guided path through the rules, for each system
- Your determination, recorded
- The duties for your role
- The records the Act asks for
- Serious-incident clocks (with Compliance Workspace or Team)
- Exports
5 AI systems
or €348/yr billed annually (~17% off)
Billed annually at €348/yr (~17% off)
Record up to 5 AI systems, work out the rules for each and keep the records the Act asks for.
14-day free trial, once per account. Cancel before it ends and you are not charged.
ForSmall organisations using a handful of AI tools.
- A register of your AI systems
- A guided path through the rules, for each system
- Your determination, recorded
- The duties for your role
- The records the Act asks for
- Serious-incident clocks (with Compliance Workspace or Team)
- Exports
10 AI systems
or €684/yr billed annually (~17% off)
Billed annually at €684/yr (~17% off)
Record up to 10 AI systems, work out the rules for each and keep the records the Act asks for.
14-day free trial, once per account. Cancel before it ends and you are not charged.
ForSMEs with AI in use across a few teams.
- A register of your AI systems
- A guided path through the rules, for each system
- Your determination, recorded
- The duties for your role
- The records the Act asks for
- Serious-incident clocks (with Compliance Workspace or Team)
- Exports
25 AI systems
or €1,584/yr billed annually (~17% off)
Billed annually at €1,584/yr (~17% off)
Record up to 25 AI systems, work out the rules for each and keep the records the Act asks for.
14-day free trial, once per account. Cancel before it ends and you are not charged.
ForOrganisations with AI in several departments.
- A register of your AI systems
- A guided path through the rules, for each system
- Your determination, recorded
- The duties for your role
- The records the Act asks for
- Serious-incident clocks (with Compliance Workspace or Team)
- Exports
50 AI systems
or €2,880/yr billed annually (~17% off)
Billed annually at €2,880/yr (~17% off)
Record up to 50 AI systems, work out the rules for each and keep the records the Act asks for.
14-day free trial, once per account. Cancel before it ends and you are not charged.
ForLarger organisations and groups.
- A register of your AI systems
- A guided path through the rules, for each system
- Your determination, recorded
- The duties for your role
- The records the Act asks for
- Serious-incident clocks (with Compliance Workspace or Team)
- Exports
No limit
or €4,476/yr billed annually (~17% off)
Billed annually at €4,476/yr (~17% off)
Record as many AI systems as you use, work out the rules for each and keep the records the Act asks for.
14-day free trial, once per account. Cancel before it ends and you are not charged.
ForOrganisations with more than fifty AI systems in use.
- A register of your AI systems
- A guided path through the rules, for each system
- Your determination, recorded
- The duties for your role
- The records the Act asks for
- Serious-incident clocks (with Compliance Workspace or Team)
- Exports
- It does not classify your AI systems for you. It shows what your answers indicate and the text behind it; the decision is yours.
- It does not file, register or notify anything with any authority, provider or person. It keeps your note of what you sent.
- It does not certify anything or carry out a conformity assessment.
- It supports deployers. It lists a provider's duties with their citations, and does not do the provider workload: technical documentation (Annex IV), a quality management system (Article 17) or conformity assessment (Article 43).
- It does not give legal advice.
- It gives no score. It counts the duties that have a record behind them.
Are you an MSP, MSSP, or Advisory Firm?
Explore multi-tenant portal tooling and 10%–30%+ recurring commission tiers in our dedicated Partner Ecosystem.
Every Engine & Agent, By Tier
No feature here is sold before it's built. Each card below is either live today, at the tier shown, or clearly marked as roadmap — never both.
Tier 1 · Assessment
- ENG-01Live
Vivid Maturity Index (VMI) & Severe Gap Penalty Engine
Computes your maturity score from your questionnaire answers, minus a penalty for the share of severe and moderate controls that came back as gaps — a severe miss costs about three times a moderate one and can’t be diluted by unrelated "Yes" answers. Every customer is asked 113 questions: 108 carry a scored control, and the other 5 are profile and history questions that record your situation rather than a control, and are excluded deliberately. Declaring software development in scope adds 5 scored secure-development questions; declaring DORA, which is offered to EU organisations and not to UK ones, adds 16 scored DORA questions; declaring UK operational resilience, which is offered to UK organisations only, adds 16 scored questions; an organisation with its country set is asked at most 134 questions, 129 of them scored. A control outside your declared scope is neither asked nor scored.
NIS2 Art. 21(1)-(2): scores the risk-management measures the Article requires - ENG-04Live
Multi-Framework Cross-Mapping Engine
Gemini-assisted mapping of your evidence against NIS2, ISO 27001, DORA & NIST CSF citations. AI-generated draft output — review before relying on it for an audit.
No single mandate — maps evidence toward NIS2 & DORA citations (ISO 27001/NIST CSF are voluntary standards, not statutory) - AGT-01Live
Vigilance-1 — Audit Readiness Agent
AI-assisted summary of your real assessment findings, on request. Shows nothing before a real assessment exists.
None independently — narrates ENG-01's NIS2 Art. 21(1)-(2) findings
Tier 2 · Compliance Workspace (Team inherits all of this)
- ENG-02Live
Evidence Freshness Decay Engine
Evidence freshness decays on a ~28.9-day half-life from upload. An authenticated cloud webhook event naming the control resets the clock without a re-upload.
None independently — keeps evidence current for the NIS2 Art. 21(2) controls it's attached to - ENG-03Live
FAIR Monte Carlo Financial Loss Simulator
A 10,000-iteration Monte Carlo simulation over your own frequency/magnitude estimates, with cited GDPR & NIS2 statutory ceilings shown alongside it.
GDPR Art. 83 & NIS2 Art. 34: statutory fine ceilings shown as reference, not a compliance requirement itself - ENG-06Live
Statutory Incident Reporting Register
Log one incident and see every statutory reporting clock it triggers across NIS2, the UK and Irish NIS Regulations, CER, DORA and the GDPR in both its EU and retained UK forms — resolved from your jurisdiction and your own scope selections, each deadline cited to its provision. Manual entry — no automated CSIRT filing.
NIS2 Art. 23 & DORA Arts. 17-19: incident classification and reporting obligations - ENG-07Live
Third-Party Vendor Registry
A flat registry of the vendors you add, with criticality and compliance status. Not a recursive sub-processor or 4th-party dependency graph.
NIS2 Art. 21(2)(d) & DORA Arts. 28-30: supply-chain / ICT third-party risk management - ENG-08Live
HMAC-SHA256 Report & Evidence Chain
A tamper-evident linear chain covering report exports, evidence uploads/reviews, and now authenticated cloud telemetry events — one chain per tenant.
None independently — evidentiary integrity supporting whichever Article a chained record documents - ENG-09Live
Remediation Spend Optimizer
An exact 0/1 knapsack, solved via bounded dynamic programming (not a greedy approximation), over your open gaps and budget.
None independently — prioritizes closing gaps against NIS2 Art. 21(2)(f)'s effectiveness-assessment obligation - ENG-11Live
CRA Article 14 Reporting Register
A private 24h/72h/final-report clock for actively exploited vulnerabilities and severe incidents in products you place on the EU market. Files nothing — no ENISA connection, no Single Reporting Platform integration, no automated submission. Shown only if you declare yourself a CRA manufacturer. All six stage timings are verified against the Official Journal text of 20.11.2024.
CRA (Regulation (EU) 2024/2847) Art. 14: reporting obligations applicable since 11 September 2026 - ENG-12Live
DORA Register of Information Export
Exports 4 of the register's 15 templates as plain CSV from your vendor registry. A data-preparation aid — not xBRL-CSV, not validated against the EBA taxonomy, not filable with the Central Bank of Ireland. All 45 column codes are verified against Annex I as corrected by the 19.9.2025 corrigendum, and against the EBA XBRL 4.0 taxonomy.
DORA (Regulation (EU) 2022/2554) Art. 28(3): the register of information on ICT third-party contractual arrangements - AGT-02Live
Sentinel-2 — Risk Prioritization & ROI Agent
AI-assisted executive narrative over a real, already-solved ENG-09 remediation allocation. Never computes a euro figure or score of its own — it only narrates numbers you already computed. Shows nothing until you solve a real allocation.
None independently — narrates ENG-09's output - AGT-03Live
Guardian-3 — Incident Reporting Agent
AI-assisted briefing over your real open incidents (ENG-06), referenced against the notification windows of the regime your own jurisdiction is under — the NIS Regulations 2018 (S.I. No. 360/2018) in Ireland, NIS2 Article 23 as transposed in the rest of the EU, the NIS Regulations 2018 (S.I. 2018/506) in the UK — timing information only, never a compliance verdict. Shows nothing when there are no open incidents.
S.I. No. 360/2018 reg. 18 (Ireland); NIS2 Art. 23 (rest of EU); NIS Regulations 2018 reg. 11 (UK): incident-reporting windows - AGT-05Live
Ecosystem-5 — Supply Chain Concentration Agent
AI-assisted narrative over your real Third-Party Vendor Registry (ENG-07): category concentration and data-access exposure computed from fields you entered. Never an automated sub-processor discovery — there is no real data source for that. Shows nothing until you have a vendor on file.
NIS2 Art. 21(2)(d): narrates ENG-07's supply-chain risk data - AGT-06Live
Sherlock-6 — Vulnerability Triage Agent
AI-assisted patching-priority briefing over your real, manually-logged vulnerabilities, sorted by real CVSS score and affected-asset count. No scan-feed ingestion, no asset-criticality correlation and no financial-exposure figure — none of those data sources exist yet. Shows nothing until you have a vulnerability on file.
None independently — narrates your logged vulnerability data
AI Act Workspace · its own plan, or an add-on to Compliance Workspace and Team
- ENG-05Live
EU AI Act Workspace — per-system classification path and duties
A per-tenant register of the AI systems an organisation uses, the vendor register's design, capped by the AI Act band. For each system a guided path shows what the answers indicate and the article behind each step; it decides nothing, and the classification is the customer's recorded determination, with reasoning, name and date, in an append-only history. The duties for the customer's role follow, each cited to a provision read in Regulation (EU) 2024/1689 as published in the Official Journal and as amended by Regulation (EU) 2026/1744, with the start dates the Omnibus set. Records: AI literacy, log retention, a fundamental rights impact assessment structured to Art. 27(1), and the customer's own note of each notification. Where the account also keeps the incident register, an incident can be linked to the AI systems it involved, and the Article 73 limits run beside the others by kind of serious incident: 15 days (Art. 73(2)), 2 days (73(3)) or 10 days (73(4)), with a deployer's route to its provider under Art. 26(5). They are the customer's own deadlines; nothing is sent. It FILES NOTHING, certifies nothing and carries out no conformity assessment; the provider workload is listed, not supported. Coverage is a count of duties with a record behind them, never a score, and the cyber VMI is untouched.
EU AI Act (Regulation (EU) 2024/1689, as amended by Regulation (EU) 2026/1744): each classification step and duty cited to its article and page
Public Roadmap — Not Sold Yet
- ENG-10
WASM High-Density Graph Offload
Planned: offload large entity-graph rendering to WebAssembly for high-density vendor/asset graphs. Not yet built.
None — rendering/performance tool, not compliance-mapped - AGT-04
Prometheus-4 — EU AI Act Narrative Agent
Planned: a plain-language summary over the AI Act workspace (ENG-05, live) of what you have recorded. Not yet built.
Will cite: EU AI Act, once built (not yet built) - AGT-07
Archon-7 — DSA Compliance Agent
Planned: track notice-and-action and transparency-reporting workflows under the EU Digital Services Act. Not yet built.
Will cite: EU Digital Services Act (not yet built) - AGT-08
Synthesizer-8 — Multi-Agent Coordinator
Planned: coordinate outputs across the other roadmap agents once they exist. Not yet built.
None — coordinates other agents' output, no citation of its own
Built On What
Actually Works.
Vivid Risk starts with a rigorous, framework-mapped self-assessment that tells you exactly where your gaps are, backed by AI-augmented findings and a full incident and vendor register. Citations follow your jurisdiction: EU NIS 2 for Ireland and the EU, and the NCSC Cyber Assessment Framework plus UK GDPR for the UK, which NIS 2 does not apply to. Evidence freshness decay, a tenant-scoped report chain, an exact remediation-spend optimizer, a FAIR Monte Carlo loss simulation over your own estimates, and a tenant-authenticated cloud webhook endpoint that chains accepted events into that same report/evidence record are all live too — with cited GDPR and NIS2 fine ceilings shown alongside the loss simulation. A CRA Article 14 reporting register and a DORA Register of Information CSV export are live as well; both are private working records that file nothing with any authority, and both say so on every screen and in every file they produce. The EU AI Act workspace is live too, on its own plan or as an add-on, with its own prices below. Automated cross-mapping of telemetry against a regulatory framework and autonomous remediation are on the roadmap — built transparently, in the open, not claimed before they exist.
VMI Self-Assessment
OnlineFramework-Mapped Scoring
Live • Deterministic, From Your Answers
Incident Register
OnlineNIS2 Art. 23 Guidance
Live • Per-Tenant Records
Vendor Registry
OnlineThird-Party Risk Tracking
Live • Per-Tenant Records
Report Chain & Evidence Decay
OnlineHMAC-SHA256 Chain, Tenant-Scoped
Live • Server-Side, OCC-Safe Append
Remediation Spend Optimizer
OnlineExact 0/1 Knapsack, VMI Gain
Live • Bounded DP, Not Greedy
Financial Loss Estimator
OnlineFAIR Monte Carlo, 10,000 Iterations
Live • Your Own Estimates
Cloud Webhook Ingest
OnlinePer-Tenant Auth, HMAC-Chained, Freshness Recovery
Live • GCP/Azure/AWS, Compliance Workspace+
CRA Art. 14 Register
Online24h / 72h / Final-Report Clock
Live • Private Record — Files Nothing With ENISA
DORA Register of Information
Online4 of 15 Templates, Plain CSV
Live • Data Prep Only — Not An xBRL Submission
Automated Cross-Mapping & Remediation
RoadmapAI Evaluation of Telemetry Against Frameworks
Roadmap • Not Yet Available
Cited to the Source
Every scored control in the core questionnaire carries its NIS2, ISO 27001, NIST CSF 2.0 and NCSC CAF citation, and its DORA or GDPR citation where it has one; the DORA-only questions cite DORA alone; the UK operational resilience questions cite those rules alone. Each is read against the framework's own published text rather than a summary of it.
Regional Focus
Ireland, the UK and the EU. Control citations follow the jurisdiction you select — EU NIS 2 for Ireland and the EU, NCSC CAF and UK GDPR for the UK, which NIS 2 does not bind. Other regions are not supported today.
Enterprise Ready
Role-based access and audit logging. Custom SSO/SAML is roadmap, not yet built.
Private & Controlled
Your assessment data stays strictly within your control.