Risk Context
The Context tab on any risk’s detail page maintains a living AI-curated understanding of that risk, proposes field updates for human review, and surfaces Suggested actions — structured one-click state transitions derived from the AI’s analysis.
What is Risk Context?
Risk Context aggregates everything VSEC knows about a risk into a single, continuously updated document. The AI synthesises the risk’s own data (evidence stream, linked threat-model graph, live score and model health), attached files, manual text entries, the context curated for the risk’s asset, and related risks with their shared links (same asset, same control, shared CVE). You can then review and apply field proposals or one-click suggested actions — or request more information from someone outside your workspace.
The Context tab is available on all risk origins: Design, Test, and Monitor.
No Intelligence Provider Configured
If no intelligence provider is enabled under Settings → Intelligence, the Context tab shows an info banner:
Connect an intelligence provider under Settings → Intelligence to enable curation.
Re-curate is disabled and the empty and suggestions areas reflect the blocked state. Enable a provider and return to the Context tab to resume curation. See Intelligence for setup instructions.
The Context Tab
Open any risk in Risk Details and select the Context tab.
Understanding Document
The top of the tab shows the understanding — a living markdown document summarising the risk as the AI currently understands it, with a Last curated timestamp. VSEC regenerates this automatically when:
- A new file is attached to the risk.
- A text entry is added or deleted.
Click Re-curate to trigger a manual update at any time. While curation is in progress the tab shows a processing indicator; the page polls automatically and refreshes when the document is ready. Back-to-back changes are debounced — a burst of uploads triggers a single curation run rather than one per file.
The understanding is read-only — each curation run regenerates the whole document from the current context.
Context Notes
Adding context — a note, a file, or a request to someone outside your workspace — happens in the Add context dialog, opened from the Add context button in the risk header or Add context… in the right-click menu. The dialog has two tabs: Add context (a note and/or files, submitted together) and Request from someone (see below).
Below the understanding document, the Context notes panel is the read/manage view of what those inputs produced:
- Each note shows its author and timestamp.
- Click the delete icon on a note to remove it — anyone with update permission on the risk can delete any entry. Deleted entries are excluded from future curation runs.
- A Requested from others list shows outstanding context requests read-only (status, response count) — managing requests (sending, revoking) happens in the Add context dialog.
Entries contributed by external collaborators via a context request appear with the contributor’s name or email and an External chip.
Documents in Context
The Documents in context list shows every file that is part of the risk’s context as a chip, with a per-file ingestion status from the last curation (hover a chip for details). If the context exceeded its size limits, a warning explains that the understanding was built from partial context and lists the files that were not fully read — consider removing or condensing older notes and files so everything fits.
AI-Proposed Field Updates
After each curation run the AI may propose updates to the risk’s core fields:
| Field | Description |
|---|---|
| Heading | Suggested title for the risk |
| Description | Suggested narrative description |
| Justification | Suggested rationale for the analysis or treatment |
| Priority | Suggested priority level |
Each proposal shows the field name, the current stored value, and the AI’s suggested value.
Tick the checkbox on each proposal you want to accept, then click Apply selected (N). Nothing is changed on the risk until you apply it; unchecked proposals are simply left alone and remain until a new curation run replaces them.
Suggested Actions
After curation, the AI may also surface Suggested actions — structured, high-confidence recommendations for state transitions that go beyond prose proposals. Each suggestion shows a confidence chip and a rationale explaining the AI’s reasoning.
Two types of suggested actions are available:
Weakness State Advancement
Advance an evidence item through the Clause-8 weakness state progression:
| Transition | Description |
|---|---|
| Event → Weakness | Promote a raw event to a confirmed weakness |
| Weakness → Vulnerability | Promote a weakness to a confirmed vulnerability |
| → Not Applicable | Mark the evidence as not applicable |
Treatment
Set the risk’s treatment decision in one click:
| Treatment | Meaning |
|---|---|
| Avoid | Eliminate the risk by changing the design or process |
| Reduce | Apply controls to lower likelihood or impact |
| Share | Transfer the risk to a third party (e.g., insurance, supplier) |
| Retain | Accept the risk as-is |
Applying a suggested action writes the change through immediately and re-scores the risk synchronously. The change is recorded as a revision (viewable via revision comparison on the Activity tab), not as its own Activity entry.
Requesting Context from Outside Your Workspace
The Request from someone tab of the Add context dialog lets you send a magic-link email to any person — they do not need a VSEC account.
Sending a Request
- Click Add context in the risk header (or Add context… from the right-click menu), then switch to the Request from someone tab.
- Enter the recipient’s email address and optionally their name and a message explaining what you need.
- Click Send request.
VSEC sends the recipient a branded email containing a one-time link scoped to that risk only. The recipient cannot access anything else in your workspace.
Request Lifecycle
The Outstanding requests list in the Add context dialog shows every request for the risk (the same requests also appear read-only in the Context tab’s Requested from others). Each row displays the recipient’s email address, current status, and response count.
| Status | Meaning |
|---|---|
pending | Link has been sent; no response yet |
responded | Recipient has submitted at least one response |
expired | Link lifetime elapsed (default 14 days) without a response |
cancelled | Manually revoked |
- The trash icon on a request — revoke the link immediately. Any further visit by the recipient returns an error.
- After the recipient submits, the status changes to
respondedand their note appears as a text entry on the Context tab (sourceemail). Any files they attached are added to the risk and a re-curation is automatically scheduled. - A link remains usable after a response: it accepts up to 10 submissions within its 14-day lifetime, then reports that it has reached its submission limit.
External Contributor Page
When a recipient visits the magic link they see a minimal public page — no login required — showing the risk name and the requester’s message. They can:
- Type a text note (up to 20,000 characters).
- Attach up to 5 files (up to 25 MB total).
- Click Submit to send their response.
After submission their note appears as a text entry (source email) and their files are attached to the risk. VSEC schedules an automatic re-curation to incorporate the new information.
Permissions
| Action | Required permission |
|---|---|
| View the Context tab | Read access to the risk |
| Add or delete text entries | Update access to the risk |
| Send or cancel a context request | Update access to the risk |
| Apply AI-proposed fields | Update access to the risk |
| Apply a Suggested action | Update access to the risk |
| Trigger Re-curate | Update access to the risk |
| External contributor page | Valid magic link (no VSEC account required) |