Kibo / Kits / Cybersecurity risk
Cyber risk, measured and treated.
Cyber risks with their exposure worked out, treatments with owners and due dates, reviews that happen on time, and a monthly picture of where the exposure is going.
Sample conversationYou
Add a risk: the old customer portal still runs an unpatched web framework. Likelihood 4, impact 4. Karim owns it.
Kibo
I'll add it with the inherent likelihood and impact you gave. The score, the rating and whether it is over appetite are worked out by the system.
Unpatched framework on the customer portalRiskOld customer portal runs an unpatched web frameworkOwnerKarim BenaliInherent likelihood4Inherent impact4Statusidentified
1 · What it runsThe processes in this kit.
Cyber risk management: the assets that matter (linked to the configuration items when the company has a CMDB), threats and vulnerabilities, a risk register with inherent and residual likelihood x impact worked out by the system, treatment, owner and review date, linked controls and security incidents, a risk appetite per entity with every risk over it flagged, and a monthly trend report.
Cyber risk management
Assets, threats and vulnerabilities; a cyber risk register with inherent and residual scores worked out by the system, treatment, owners, review dates; risk appetite per entity; monthly trend.
Records: information assets, threats, vulnerabilities, risk appetite, cyber risks
2 · Examples
Real requests, and the card each one produces.
Sample conversationYou
Add a risk: the old customer portal still runs an unpatched web framework. Likelihood 4, impact 4. Karim owns it.
Kibo
I'll add it with the inherent likelihood and impact you gave. The score, the rating and whether it is over appetite are worked out by the system.
Unpatched framework on the customer portalRiskOld customer portal runs an unpatched web frameworkOwnerKarim BenaliInherent likelihood4Inherent impact4Statusidentified
Sample conversationYou
A critical vulnerability was found on the VPN gateway. It must be fixed within a week.
Kibo
I'll record it as open with severity critical and a fix-by date one week from today. The asset's owner is reminded 3 days before.
VPN gateway vulnerabilityVulnerabilityCritical vulnerability on the VPN gatewayAssetVPN gatewaySeveritycriticalFix by14 Nov 2026Statusopen
3 · Approvals and remindersRules it sets up, enforced by code.
- Reminder · cyber risks: 7 days before “next review”
- Reminder · cyber risks: 7 days before “treatment due”
- Reminder · vulnerabilities: 3 days before “fix by”
- Report · A summary to the manager, the 1st of each month at 9:00