Frequently Asked Questions

RiskMatrix helps industrial teams understand their OT assets, view associated vulnerabilities, explore possible attack paths and prioritize remediation. It turns complex asset and vulnerability data into clear, actionable insights for better security decisions.

No. RiskMatrix works with asset inventories and data exports supplied by your organization or partners. It does not actively scan, probe or monitor your network.

RiskMatrix uses asset information such as asset name/ID, IP/MAC, manufacturer and model, firmware or software versions, operating system, open ports and services, topology and protocols, provided by you or through your partners.

RiskMatrix maps vulnerabilities to assets using enriched vulnerability intelligence (e.g., CVE data), asset attributes and product information to provide relevant and deduplicated results.

Yes. RiskMatrix analyzes asset data and vulnerabilities to identify possible multi-step attack paths from initial access to potential impact, helping you prioritize the most important risks.

No. RiskMatrix provides remediation guidance and recommendations. Applying fixes is performed by your team through your existing change management processes.

Continuous ethical hacking provides ongoing security assessments, helping to identify and address vulnerabilities in real-time. This proactive approach minimizes the risk of breaches and ensures a more robust security posture compared to periodic testing.

We utilize specialized techniques and controlled environments to perform ethical hacking without impacting your live operations. Our methods are designed to be non-disruptive, ensuring business continuity while security assessments are underway.

As per our research, the vendor typically covers 20%–40% of all OT assets in their extensive tests. The risks of ransomware attacks and other breaches is not completely addressed. By shifting to the digital replica, 100% of your OT assets can now be part of the ethical hacking.

Pilot data is used only for the agreed pilot purpose and is deleted within 30 days after the pilot, unless a commercial agreement is signed.

Data security is paramount. We employ a multi-layered approach including encryption, access controls, regular audits, and adherence to industry best practices to protect your sensitive information from unauthorized access and cyber threats.

Yes. RiskMatrix provides asset, vulnerability and risk insights that can support risk assessment and risk treatment activities for standards such as ISO 27001 and IEC 62443. It does not guarantee compliance.

RiskMatrix is designed to help organizations meet a variety of compliance standards, including GDPR, ISO 27001 and IEC/ISA 62443. Our solutions provide the necessary tools and reporting to demonstrate compliance effectively. RiskMatrix does not guarantee compliance.