Compliance data this sensitive should never leave your network.

Compliance & incident registers

Track compliance obligations, evidence and approvals with full version history. Log incidents, manage response and record post-incident reviews, with every record auditable and entirely under your control.

NCSC CAF posture, outcome by outcome

Contributing-outcome achievement for every CAF principle, rolled up to the four objectives from managing security risk to minimising impact. Assess each outcome as Achieved, Partially achieved or Not achieved in place, and the principle coverage heatmap shows where the gaps cluster.

A dashboard that knows your job

The home dashboard is built from modules and follows your role: an incident commander lands on the incidents they command, response-time metrics and regulatory clocks; a risk lead lands on risks above appetite and their own submissions. Every user can customise their layout, and quick actions keep new risk, report incident and POA&M one click away.

Regulatory reporting clocks

When an incident lands, RaptorGRC works out which reporting regimes apply (NIS2, UK GDPR, DORA and any custom regime you define) and starts the clocks. Early-warning, notification and final-report deadlines count down in real time, every regulator submission is recorded against the incident, and deadlines at risk are flagged while there is still time to act.

The same work, on a timeline

Flip the board to a gantt view: planned start to due date for every piece of work, overdue bars in red, a today line so the room can see exactly where the programme stands. Delivery chains plot left to right, so the sequence of design review, risk assessment, supplier assessment and security testing is visible at a glance.

Vulnerability findings, tied to systems

Import Nessus scan results or record findings manually. Every finding sits against the system and asset it affects, with CVE, CVSS score and severity. Critical findings promote straight into the risk register, so scanner output ends up in the risk register rather than in a spreadsheet with no owner.

Supplier assurance on a cadence

Third-party suppliers with criticality, risk score, contract status and renewal dates, linked to the systems they support. Assurance assessments run on a cadence you set, and overdue reassessments are flagged in red, so overdue reviews get chased rather than forgotten.

Threat modelling on a canvas

Map a system's attack surface visually. Drop entities, processes, data stores and trust boundaries on a canvas, connect the data flows, and tag each element with its TRACE threat domain and STRIDE categories. Assign threats from the built-in TRACE taxonomy to any element or flow and score them with DREAD. Data-flow diagrams and attack trees, all stored on your own servers.

The model shown is a real RaptorGRC threat model: a multi-vector attack against an AI platform (prompt injection, RAG and training-data poisoning, model exfiltration and excessive agency) across four trust zones, with the count on each element showing its assigned TRACE threats.