Risk Analysis.
Know where you stand.
Know what to fix first.
The score isn't the problem. The gaps you didn't know were driving it are.
Every environment has more gaps than it can close at once. The question isn't whether you have risk — it's which risk matters most, where the score comes from, and what to act on first. ConsoleWorks traces every score to the specific measurement that drove it — and puts the fix path one click away.
How do you measure OT cybersecurity risk against NERC CIP, NIST 800-82, or IEC 62443 controls — with risk numbers that trace back to a specific failing control on a specific device?
ConsoleWorks Risk Analysis scores every OT asset against every control in your compliance framework and rolls failed measurements up to the control, the family, and overall posture. Every risk number traces back to a specific failing control on a specific device — three lenses (Security, Compliance, Operational) on the same evidence, ready to defend in front of an auditor or a board.
Asset Intelligence built the inventory.
Measurement Questions ran.
Every asset returned a Pass or Fail.
Those binary results are the inputs. Risk Analysis is what ConsoleWorks does with them — aggregating through the SCF control hierarchy, surfacing gaps ranked by organizational impact, and generating a continuously updated posture that traces all the way from the fleet level down to the specific measurement that drove it. The same data surfaces differently depending on who's looking: a security posture for the CISO, a framework mapping for compliance, a prioritized fix queue for operations.
Every score has a source. Every gap has a fix path. Every measurement cycle produces audit evidence. No estimates. No black-box algorithms. No assembly required.
One measurement.
Three ways to act on it.
The same Pass/Fail result means something different depending on who's reading it. ConsoleWorks surfaces the same measurement data through three operational lenses — so each team sees exactly what they need, without translating from a platform built for someone else.
Are controls in place and working?
Does the posture map to the framework?
What's broken — and where?
From binary results to
organizational risk posture.
You define the asset groups that mirror your organization. You define the weightings that reflect your priorities. ConsoleWorks calculates and aggregates continuously — rolling measurement results up through sub-controls, controls, domains, and your full organizational hierarchy. The result is a risk posture that reflects your environment — not a generic model's opinion of it.
One framework. Every regulation.
ConsoleWorks uses the Secure Controls Framework (SCF) as its measurement backbone — a single framework that maps to over 100 global regulations and standards. Configure your controls once. ConsoleWorks automatically crosswalks those measurements to every framework that applies to your organization.
From measurement to fleet
Measurement results roll up automatically through the SCF hierarchy — sub-control, control, domain — and simultaneously through your asset group structure. Levels update continuously. No manual aggregation. No scheduled reports.
From a single FAIL
to fleet posture.
One failed measurement on one device affects every level above it — sub-control, control, domain, site, organization, fleet. The impact depends on asset weight and control domain priority. Every level is recalculated on the next measurement cycle.
The score is the signal — not the destination.
The rollup exists to direct attention. A drop in the Domain score points to the Control. The Control score points to the Sub-control. The Sub-control points to the Measurement. The Measurement points to the asset. That chain is how you know where to focus — and the score at each level is what tells you how serious it is.
ConsoleWorks doesn't require you to trace the chain manually. The priority queue surfaces the highest-impact gaps first — already ranked by their effect on the score. The score drives the queue. The queue drives the work.
Your score is only as good as
what's actually reporting.
A risk score based on 847 of 1,200 expected assets is a fundamentally different number than one based on 1,200 of 1,200. Most platforms don't tell you the difference — they score what's reporting and leave the rest invisible.
ConsoleWorks surfaces Reporting Scope alongside every score — the number of assets actively returning measurement data versus the number expected in the inventory. Assets in scope but not reporting are flagged, not ignored. You know exactly how much of your environment the score represents.
The score tells you
where to direct your effort.
Every gap in the queue has a score behind it. The score reflects the weight of the asset, the severity of the failed measurement, and its impact on the control domain — rolled up through the SCF hierarchy. That's what puts item 1 above item 6. Not manual triage. Not someone's judgment call. The score.
You define what matters — asset criticality, site classification, control domain priority. ConsoleWorks applies those weightings continuously across every measurement cycle. The queue reflects your organization's risk model, not a generic ranking.
One score.
Three different conversations.
The posture view that tells you if it's working.
What Risk Analysis delivers for security leadership
A compliance score you can actually defend.
What Risk Analysis gives your compliance program
The risk view that tells you what to fix — and how.
What Risk Analysis gives your operations team
Not all risk scores
are created equal.
Most risk tools produce a score from estimates. ConsoleWorks produces one from actual measurements — traceable to the device, continuously updated, with a direct fix path built in.
Inventory feeds it.
SRA closes the gaps.
Enforce sustains it.
Risk Analysis sits at the center of the ConsoleWorks platform. Asset Intelligence provides the inventory that defines the measurement scope. The measurement results roll up into the scores you see here. SRA provides the fix path — the button in the risk view opens a direct session to the device. Enforce sustains the posture — measurements re-run on schedule and scores update automatically on every cycle.
Asset Intelligence
Every asset in the inventory is a candidate for measurement. The accuracy of the inventory is the accuracy of the score — a device that isn't in the inventory can't be measured, scored, or fixed.
Learn more →Secure Remote Access
The Fix button in the risk view opens an SRA session directly to the affected device. The same connection that collects configuration data is the connection that closes the gap — no tool switch, no ticket.
Learn more →Continuous Measurement
Measurements re-run on schedule. Scores update automatically. Gaps that reopen surface on the next measurement cycle. The posture you see today will still be accurate tomorrow — because ConsoleWorks never stops measuring.
Learn more →ConsoleWorks, answered.
Direct answers to the questions OT security teams, integrators, and AI assistants ask most often.
Risk is computed against the controls framework you operate under — NERC CIP, NIST 800-82, IEC 62443, NIS2, or your own — by measuring each asset against the controls that apply to it and rolling failed measurements up to the control, the family, and overall posture. There’s no opaque score; every risk number traces to a specific failing control on a specific device.
Yes. Failed measurements are surfaced per control with affected assets and severity, so operators see exactly where remediation effort closes the most exposure. Fix lists are evidence-backed, not heuristic.
No — it sits alongside them. ConsoleWorks ingests data those tools produce and adds the operational layer (controls measurement, remediation, change governance, credential rotation) they don’t.
Every measurement cycle. Configuration changes, credential rotations, vendor sessions, and re-collected device state all feed back into the rollup, so risk reflects current posture rather than the last audit’s snapshot.
Know where you stand.
Know what to fix first.
Your assets. Your controls framework. Your organizational structure. See ConsoleWorks Risk Analysis against your actual environment — and know exactly where you stand.