Review every AI project the same way.
AI Risk Navigator is the review workbench for security teams that assess AI systems. From the business use case and the design decisions, it shows which risks actually matter and what it takes to close each one. The result is a versioned Solution Strategy that engineering can build from and audit can stand behind.
The problem
A review that works for ten projects fails at fifty.
Most AI reviews today depend on one experienced reviewer. The reviewer reads the design, asks some questions, and approves the project with conditions. With ten projects a year and the same reviewer every time, this is adequate.
With fifty projects and three reviewers it is not. The same risk gets a different treatment depending on who picked up the ticket. Conditions are written into the approval and nobody checks whether they were met. A year later no one can say what a project was approved against. The organization ends up carrying AI risk that nobody decided to accept.
What changes
The same review for every project, against your own governance.
- Anyone can run the review.A project team describes its system and gets the risks, controls and gaps. The reviewer checks the result.
- Your governance comes from the framework.Write your policies and standards from it, import them as Governance and Design Patterns, and every review applies them.
- Credit for what you already have.Record your existing security platforms and controls once. Reviews show only what is missing.
- Gaps close faster.Each open gap lists the commercial and open source solutions that close it.
- It connects to engineering tools.A REST API and an MCP server let coding assistants read the decisions.
The framework: each risk, the capabilities that address it, the guidance to build them. Click a screenshot to enlarge.
A review, start to finish
From a request to a signed Solution Strategy.
Four stops; click one to see the screen.
Click the screenshot to enlarge.
Closing the gaps
Know which solutions close each gap.
Vendor Intelligence researches commercial and open source AI security solutions against the same capabilities the review scores.
At Vendor Evaluation the candidates are already narrowed to the gaps you chose to close. Smart Combos finds the smallest set that closes the most, and a side-by-side comparison shows whether two solutions overlap.
Build and buy
The AI you build and the AI you buy, scored against the same risks.
One risk model, so a system your engineers built and a product with AI added sit in one portfolio and compare.
The five steps, as the product names them.
- System Characteristics. Data classification, access, hosting, autonomy, coding-assistant use, regulations.
- Architecture Components. What the system is made of. Each component activates or amplifies risks.
- Risk Profile. The applicable risks ranked P0 to P3, with existing coverage counted first.
- Capability Decisions. One recorded choice per gap. Accepting a risk requires a rationale and a review date.
- Vendor Evaluation. Compare solutions by capability, or let Smart Combos pick.
Risk Posture: exposure after each stage of the review.
Use it for a SaaS product that has added AI. Each control is split into what the vendor must do and what you must do.
- Send the questionnaire. Exported as Excel, CSV, JSON or a fillable PDF.
- Import the response. Each item is marked Met, Partial, Not met, Refused or Missing.
- Decide. Approve, Approve with conditions, Re-ask, or Reject. A follow-up packet goes back for anything re-asked.
TPRM Brief: criticality, inherent and residual risk, and the recommendation.
Across projects
Portfolio Intelligence
Once two or more projects have reached their decisions, compare them. This one is live: select projects and switch between the analyses.
Fits what you have
It works with the tools you already run.
Integrations
Coding assistants and internal tools can read a project's risks, decisions and open gaps through the MCP server or the REST API. Access is by API key, scoped to what each integration needs.
Framework crosswalks
Each risk and capability maps to NIST AI RMF, OWASP LLM Top 10, MITRE ATLAS and the EU AI Act, so a finding can be reported in the framework your auditors use. The EU AI Act mapping goes to article level.
Make it your method
Org admins adjust how much each risk counts, add architecture components the framework does not have, and swap the built-in build guidance for their own design patterns.
Questions
Who is it for?
Security architects and AI security leads who review the AI projects in their company, and the advisory firms that run those reviews for clients. The strongest fit today is a security architecture team of two to ten in a regulated industry with a review backlog.
What does it not do?
It does not enforce controls at runtime. It tells you which controls you need, how to build them, and which solutions provide them. Enforcement stays with your platforms, gateways and code.
Can we use it to build our governance framework, risk register and control library?
Yes. The risks are a starting risk register; the capabilities are a control library, downloadable as JSON. Write your policies and standards from them, then record each one as a design pattern mapped to the capabilities it covers, one at a time or in bulk with the AI import. Every review then applies your patterns, and each Solution Strategy shows which ones apply under Security Baselines.
How does it help us choose security products?
Vendor Intelligence assesses more than 100 solutions against the same capabilities the review scores. When you reach Vendor Evaluation the candidates are already narrowed to your open gaps.
Which frameworks are cross-walked?
NIST AI RMF, OWASP LLM Top 10, MITRE ATLAS and the EU AI Act. The EU AI Act view maps at article level. The other three are crosswalk views and do not yet cover every risk in the current model.
Can we change the method?
Yes. Org admins tune risk relevance, add custom architecture components, and replace the built-in build guidance with their own design patterns.
How do we get started?
Request a demo below. We walk you through the product on your own use case, then set up your organization. There is no self-service sign-up.