How Scarlet Risk Works: Methodology & Limitations

Scarlet Risk helps small businesses see where they are exposed and what to fix first. It works with four kinds of information:

• Your answers. The free Risk Snapshot asks seven questions about security ownership, vendors, AI use, compliance documentation, access management, incident readiness and your main concern.
• Your company profile. Industry, size, the frameworks you are working toward, maturity and primary concern. This shapes the risk register and policies.
• Work you complete in the platform. For example, a generated incident response plan, a password policy, a vendor assessment or a completed security quiz.
• Public threat information. Intel briefings and World Watch summarize public sources; they are context, not a measurement of your systems.

Throughout the platform, we label what is confirmed in your account separately from what is AI-inferred or self-attested.

Risk Snapshot score (rule-based)

Six of the seven Snapshot questions are scored. Each answer carries 0 to 4 points; a higher number means more exposure. Choosing "Not sure" scores 3 points, because an unknown is itself a gap. The seventh question, your primary concern, is not scored. The maximum total is 24.

Your two highest-scoring areas are shown as the top areas to look at first. Scoring runs on our server; the same answers always produce the same result.

Compliance checklist score

Inside the platform, your compliance score is the share of checklist items marked complete. Four items are ticked automatically only when real evidence exists in your account: an incident response plan, a password policy, a vendor assessment and a completed security awareness quiz. Every other item is self-attested: you mark it yourself.

Risk register ratings (AI-generated)

Each risk in the register has a likelihood (Low, Medium or High), an impact (Low, Medium or High) and an overall risk level (Low, Medium, High or Critical). These ratings are proposed by the AI from your company profile. You can change a risk's status, notes and controls, and your edits are kept when the register is refreshed.

Rule-based (no AI): the Risk Snapshot score and exposure band, the selection of your top two areas, and the automatic checklist ticks, which depend only on whether the evidence exists in your account.

AI-generated: the risk register and its ratings, drafted policies, incident response plans, risk intelligence reports, phishing simulation pretexts and answers from the Scarlet Intelligence assistant. These are drafts for you to review.

The AI does not change your Snapshot score. It also does not tick checklist items for you or mark a control as confirmed without evidence in your account.

AI output can be wrong or incomplete. Review drafts before you rely on them or share them with a customer, insurer or auditor.

Scarlet Risk publishes plain-English guidance for SOC 2, CMMC, HIPAA, ISO 27001 and PCI DSS.

The policy generator maps drafted policies to SOC 2, HIPAA, CMMC or PCI DSS, based on the frameworks you select. The risk register takes your selected frameworks into account.

The Risk Snapshot is a general risk view. Its result is not mapped to the controls of any specific framework.

• Snapshot answers, your company profile and work you create in the platform are stored in your account.
• AI features send the relevant information to our AI model provider to generate the output. Our Privacy Policy lists the providers we use.
• Evidence files are encrypted with AES-256-GCM envelope encryption and stored in a private bucket with no public URLs.
• Vendor risk signals are shared across customers only in de-identified form, and only after at least three assessments of the same vendor.
• Threat context comes from public sources. World Watch updates hourly from GDELT and U.S. State Department information; intel briefings are compiled daily.
• You can ask us to delete your account data. We complete verified deletion requests within 30 days, except for records the law requires us to keep.

Scarlet Risk is not a certification, not an audit, and not a penetration test. It does not replace an auditor or a qualified security professional for formal attestations.

• The Risk Snapshot reflects only your answers. It does not scan, test or connect to your systems.
• Self-attested checklist items are not independently verified.
• AI-generated registers, policies and reports can contain errors and need human review.
• Checks inside the platform run when you request them. Scarlet Risk does not monitor your systems around the clock.
• Scarlet Risk does not provide legal advice or insurance advice.

Does AI decide my Risk Snapshot score?

No. The Risk Snapshot score is calculated on our server by fixed rules: each of six scored answers carries 0 to 4 points, and the total maps to a fixed band. No AI model is involved in the Snapshot score.

Which parts of Scarlet Risk are AI-generated?

The risk register (including each risk's likelihood, impact and risk level), drafted policies, risk intelligence reports and assistant answers are AI-generated drafts. You can review and edit them before relying on them.

Is Scarlet Risk a certification or an audit?

No. Scarlet Risk is not a certification, not an audit and not a penetration test. It does not replace an auditor or a qualified security professional for formal attestations.

Which frameworks does Scarlet Risk cover?

Scarlet Risk publishes guidance for SOC 2, CMMC, HIPAA, ISO 27001 and PCI DSS. The policy generator maps drafted policies to SOC 2, HIPAA, CMMC or PCI DSS.

Is the Risk Snapshot based on a scan of my systems?

No. The Risk Snapshot is based only on your answers to seven questions. It does not scan, test or connect to your systems.

Does Scarlet Risk use my data to train AI models?

No. Scarlet Risk does not use customer data to train AI models.