## Risk register

Not every finding gets fixed. Some are accepted — the cost of remediation outweighs the risk, or a compensating control already handles it. The risk register makes that decision explicit, attributable and time-bound rather than leaving it as a finding nobody touches.

### Creating a risk record

From **Risk Register**, create a record against a finding with:

- **Finding ID**
- **Owner** — the person accountable for the acceptance
- **Expires at** — required; acceptances are never open-ended
- **Business justification** — 10 to 5000 characters
- **Compensating controls** — what mitigates the risk in the meantime

The record starts as **Pending**.

### Approval

A user with risk approval rights can **Approve** or **Reject** a pending record. Approval stamps the acceptance timestamp and the approver's identity. The finding moves to Risk Accepted.

Approval is a separate permission from creation, so the person requesting an acceptance generally isn't the person granting it. In an SMB workspace the Analyst role can create and export risk records but cannot approve them, for exactly this reason.

### Expiry

When a risk record reaches its expiry date, Perimeter automatically expires it and **reverts the finding to Open**. Accepted risk comes back for review on a schedule rather than being forgotten.

Accepted findings keep a reduced priority score rather than disappearing — they stay visible but rank low, and the reduction is shown as an explicit factor.

### Viewing and exporting

Filter by status (Pending, Approved, Rejected, Expired). The detail panel shows owner, timestamps, approver, full justification, compensating controls, control mappings and the linked finding. Export the register as **XLSX** or **CSV**, honouring your current filter.

---

## Reports

The **Reports** screen has Reports and Schedules tabs.

### Report types

- **Executive summary** — posture and trend overview for leadership.
- **Findings detail** — the full finding list with evidence.
- **Posture summary** — scoring breakdown.

### Generating one

Choose an organization, a report type and optionally a date range. The report appears as Pending and flips to Ready with a **Download** button when the PDF has rendered. The list polls automatically while anything is pending.

### Scheduling

Build a recurring schedule — daily, weekly or monthly, with a time and a day-of-week or day-of-month, in your chosen timezone. Add a name, optionally **Include Asset Owners**, and list additional recipients as comma-separated email addresses.

Schedules can be enabled, disabled, edited or deleted. The organization is fixed once a schedule is created.

---

## Graph explorer

The graph shows how your assets relate to each other for a given completed scan — which domains resolve to which addresses, which services run where.

Pick a completed scan and the graph renders in a force-directed layout with counts of nodes, edges and node types. Click a node to highlight it and its immediate neighbours; click the background to clear. Scroll to zoom, drag to pan. Export as **JSON** or **SVG**.

The graph deliberately contains **assets only**. CVEs are not graph nodes — they belong to findings on assets, and putting them in the graph turns a readable topology into noise.

The graph is built per scan, so it shows the topology as it was at that point in time rather than a live view.