Automate security risk tracking

Keep risk scores, owners, and review dates in one register. Route exceptions for a documented decision and prepare digests for the people accountable for each risk.

Tools for risk management strategy

MCP servers for the tools used in these examples.

Automation examples and starter prompts

Paste a prompt into Claude Code, Microsoft Copilot, or Codex connected to Tracecat MCP. Adapt it to your tools and test before deployment. Human tool approvals and advanced case features require Enterprise.

Stand up a living risk register

GV.RM-06

Build me a risk register in Tracecat. Create a table with a standardized scoring method: likelihood, impact, inherent and residual risk, owner, and review date. Add an intake path so a risk can be raised from a Tracecat case or a Slack message, scored with the same rubric, and routed to the right owner. Open a Jira ticket for any risk above our review threshold. First help me understand how this maps to GV.RM-06 and why a standardized calculation method matters more than the scores themselves. Ask me what scoring scale we use today, if any. Talk me through keeping the register honest: review cadences, stale-risk flags, and who can accept a risk.

Enforce risk appetite in triage

GV.RM-02

Build me an automation in Tracecat that encodes our risk appetite statements as triage rules. When a case involves a critical asset, regulated data, or external exposure beyond the stated tolerance, escalate it automatically, require a documented decision, and record who accepted what. Post a monthly summary of accepted risks and tolerance breaches to the leadership channel. First help me understand how this maps to GV.RM-02 and how appetite statements become operational rules instead of shelf documents. Ask me what our current appetite statements say, and help me sharpen them if they are too vague to encode. Talk me through which decisions must stay human and which the automation can apply.

Feed security risks into enterprise ERM

GV.RM-03

Build me a monthly workflow in Tracecat that translates our security risk register into the enterprise risk format. Pull the top risks by residual score, convert them to the ERM categories and scales used in ServiceNow, attach the trend since last month, and have an AI agent draft the one-page narrative in Notion for the risk committee. First help me understand how this maps to GV.RM-03 and why cybersecurity risk loses influence when it stays in its own silo. Ask me what format and scales the enterprise register uses. Talk me through handling risks that do not translate cleanly into enterprise categories.

Open lines for risk communication

GV.RM-05

Build me a risk communication digest in Tracecat. Each week, collect new and changed risks from the register, including supplier and third-party risks, group them by business area, and send each area's digest to its owner in Slack with a reply path that records questions and decisions back to the case. Send the executive version by email monthly. First help me understand how this maps to GV.RM-05 and what good two-way risk communication looks like in practice. Ask me which business areas and owners should receive digests. Talk me through tuning frequency so the digest stays read instead of muted.

NIST CSF 2.0 mapping: GV.RM

Official NIST category: Risk Management Strategy. The organization's priorities, constraints, risk tolerance and appetite statements, and assumptions are established, communicated, and used to support operational risk decisions

The controls and implementation examples below are NIST source material. The automation prompts above are Tracecat-authored starting points, not evidence of compliance or full control coverage.

GV.RM-01
PM-9
RA-7
SR-2
Risk management objectives are established and agreed to by organizational stakeholders
- Update near-term and long-term cybersecurity risk management objectives as part of annual strategic planning and when major changes occur
- Establish measurable objectives for cybersecurity risk management (e.g., manage the quality of user training, ensure adequate risk protection for industrial control systems)
- Senior leaders agree about cybersecurity objectives and use them for measuring and managing risk and performance
GV.RM-02
PM-9
Risk appetite and risk tolerance statements are established, communicated, and maintained
- Determine and communicate risk appetite statements that convey expectations about the appropriate level of risk for the organization
- Translate risk appetite statements into specific, measurable, and broadly understandable risk tolerance statements
- Refine organizational objectives and risk appetite periodically based on known risk exposure and residual risk
GV.RM-03
PM-3
PM-9
PM-30
RA-7
SA-24
SR-2
Cybersecurity risk management activities and outcomes are included in enterprise risk management processes
- Aggregate and manage cybersecurity risks alongside other enterprise risks (e.g., compliance, financial, operational, regulatory, reputational, safety)
- Include cybersecurity risk managers in enterprise risk management planning
- Establish criteria for escalating cybersecurity risks within enterprise risk management
GV.RM-04
PM-9
PM-28
PM-30
SR-2
Strategic direction that describes appropriate risk response options is established and communicated
- Specify criteria for accepting and avoiding cybersecurity risk for various classifications of data
- Determine whether to purchase cybersecurity insurance
- Document conditions under which shared responsibility models are acceptable (e.g., outsourcing certain cybersecurity functions, having a third party perform financial transactions on behalf of the organization, using public cloud-based services)
GV.RM-05
PM-9
PM-30
Lines of communication across the organization are established for cybersecurity risks, including risks from suppliers and other third parties
- Determine how to update senior executives, directors, and management on the organization's cybersecurity posture at agreed-upon intervals
- Identify how all departments across the organization - such as management, operations, internal auditors, legal, acquisition, physical security, and HR - will communicate with each other about cybersecurity risks
GV.RM-06
PM-9
PM-18
PM-28
PM-30
RA-3
A standardized method for calculating, documenting, categorizing, and prioritizing cybersecurity risks is established and communicated
- Establish criteria for using a quantitative approach to cybersecurity risk analysis, and specify probability and exposure formulas
- Create and use templates (e.g., a risk register) to document cybersecurity risk information (e.g., risk description, exposure, treatment, and ownership)
- Establish criteria for risk prioritization at the appropriate levels within the enterprise
- Use a consistent list of risk categories to support integrating, aggregating, and comparing cybersecurity risks
GV.RM-07
PM-9
PM-18
PM-28
PM-30
RA-3
Strategic opportunities (i.e., positive risks) are characterized and are included in organizational cybersecurity risk discussions
- Define and communicate guidance and methods for identifying opportunities and including them in risk discussions (e.g., strengths, weaknesses, opportunities, and threats [SWOT] analysis)
- Identify stretch goals and document them
- Calculate, document, and prioritize positive risks alongside negative risks

Control text and SP 800-53 Rev 5 references from the official NIST CSF 2.0 and OLIR releases.

Build your own security automation

Adapt a starter prompt with your coding assistant, choose where AI agents or fixed workflows fit, and test with your tools.

All examples Book a demo