From signal to governance
Detecting a risk and being accountable for it are not the same job.
A live feed of alerts tells an operator what's happening right now. It doesn't tell a risk officer what the organisation is exposed to, who owns it, whether it's covered, or whether it's getting better or worse over time. Risk Protection is what happens after Risk and Trajectory Intelligence raise a signal — a persistent register, not a feed.
Keep a register, not a feed.
Items persist and are categorised by type — operational, financial, compliance, external — because each has a different owner in a real organisation. Every status change is attributed to a person and timestamped.
Compute severity and likelihood, don't guess them.
Impact is calculated from real exposure where it's knowable, and left honestly blank where it isn't — never double-counted across categories. Every likelihood figure discloses the evidence it rests on.
Make concentration and coverage visible.
Surface where a critical share of activity depends on a single partner or resource with no alternative in place, and split every exposure figure into covered, retained, and unknown. Because items attach to the entities that actually carry the risk, the register can see what a flat list cannot — that three separate hub-concentration items are one common cause wearing three hats. Exposure sitting behind a single shared dependency is identified as such, and counted once.
Hold the organisation to its own tolerance.
Every operation defines its own thresholds — maximum exposure, maximum concentration, maximum uninsured risk. A breach records exactly which rule was crossed and by how much.
Escalate and report without reformatting.
Items that cross a threshold route automatically to their owner. The register exports as a board- or auditor-ready report exactly as it appears live.
Detection tells you something is wrong. Governance tells you who owns it, what it's worth, whether it's covered, and whether the organisation is honouring its own tolerance for it.