PurpleWASP Resources
Practical guidance for security, risk, compliance, policy and governance teams—written to help you make better decisions.
Search the knowledge base
Featured article
Cyber Risk ManagementInherent risk shows what an activity is capable of with no controls in place. Residual risk shows current exposure with controls applied. Confusing the two, or reporting only one, is one of the most common ways risk reporting misleads decision-makers.
Cee-Jay
9 min read
Latest thinking
Spreadsheets once made compliance manageable, but growing regulations, complex operations, and increasing audit demands have exposed their limitations. Discover why modern compliance teams need connected GRC technology that provides real-time visibility, reliable audit trails, and a single source of truth.
Cupcake ipsum dolor sit amet. Caramels biscuit halvah lollipop carrot cake I love wafer. Wafer tart pudding dragée sweet icing chupa chups toffee I love.
A critical CVSS score tells you that a vulnerability could cause serious technical harm. It does not tell you whether that vulnerability represents your organisation’s greatest business risk. Effective prioritisation requires evidence of exploitation, asset context, control effectiveness and an understanding of the potential financial loss.
“Ransomware is a risk” tells you nothing useful. A cyber risk scenario connects a threat, an asset, an attack path, existing controls and a business consequence, turning a vague concern into something you can actually assess, prioritise and act on.
An exception is a temporary bridge toward compliance. Risk acceptance is a considered decision to carry a risk long-term. Treating one as the other is how organisations end up carrying risk nobody ever actually agreed to.
Red, amber, and green squares look precise, but they’re built on ordinal labels doing arithmetic they were never designed for, and they can’t show tail risk, inconsistent scoring, or shared dependencies. Here’s what a more defensible approach to risk reporting looks like.
Most risk registers get built for an audit and opened once a year. Here’s how to build one leadership will actually use: specific scenarios instead of vague categories, real ownership split across four distinct roles, evidence-backed residual risk, and a report built around decisions rather than compliance.
