Flagship
Security risk assessment aligned with ITSRM2, extended for AI and supply chain risks.
A formal information security risk assessment is often done in a spreadsheet. Rows are copied by hand, ratings and mitigation effects are looked up manually, and the reference spreadsheet caps an assessment at 20 primary assets and 5 measures per risk. The base threat catalogue predates AI systems and modern software supply chain attacks, and risk is expressed only as levels, not as money. Regulation such as NIS2 or DORA usually becomes a separate paper exercise next to the assessment.
I built ITSRM2+ for my own use while working on risk assessment projects. I wanted to learn the methodology in depth, and to have my own tool where I can add new threats and new measures, adapt them and suggest additions on each project. I also wanted a wiki that explains every element and how it works in the background, so the tool teaches me something about cybersecurity every day.
ITSRM2+ guides you through a complete, documented risk assessment aligned with the publicly available ITSRM2 methodology. You describe the system, value what matters, generate risk scenarios, choose and apply security measures, and publish a frozen version with its register and reports. On top of the base method it adds AI and supply chain threats, compliance packs that turn regulation into required measures, and estimates of financial exposure next to the qualitative risk levels. Its structure is similar to GovSec, the official tool, so work done in ITSRM2+ is easy to transfer there.
Scope
Create an assessment, choose an impact vocabulary (institutional, private sector or public sector), and describe the system, security roles, constraints and risk acceptance criteria. Optionally attach a compliance pack, which pre-loads the measures it requires.
Value and model
Add primary assets (datasets and business functions), value them on confidentiality, integrity and availability through impact scenarios, then add and link the supporting assets that carry them.
Expose
Generate risk scenarios from the threat library for every applicable asset and threat pair, then review and adjust them.
Decide and treat
Compare inherent and residual risk, choose Mitigate, Accept, Share or Avoid, pick measures from a ranked list of recommendations and see residual risk recalculate.
Prove
Validate the assessment against the publication rules, publish an immutable version and export the register and reports.
The ITSRM2 methodology is public. ITSRM2+ adapts and extends it; the method itself is not mine. The workflow is built on its seven processes, grouped into six stages:
What is extended over the base method:
Today ITSRM2+ is mainly for my own use and for showing a client the work done. Every output is a one click export:
Every step of the method has its own screen, from system characterisation to publication. Asset values are backed by impact scenarios and adversary profiles, so each rating can be explained to an auditor. An asset journey view follows one primary asset from its value to its final risk verdict.
Risk scenarios are generated from a library of over 125 threats and over 130 measures that covers AI systems, software development and third party risks, not only the classic catalogue. The library is editable and versioned, so new threats and measures can be added on each project. Every threat, measure and asset type has an explanatory help card in English and Greek, searchable in a built in wiki.
For each scenario the tool ranks recommended measures, lets you apply measures from the library or your own register, and recalculates residual risk. Overrides need a stated reason. The per risk limit of 5 measures from the reference spreadsheet does not apply.
Curated, versioned packs turn regulation and security standards, such as NIS2, GDPR, DORA and the EU AI Act, into required measures. Each requirement is resolved as implemented, accepted, alternative, rejected or not applicable, with a justification where needed, and a coverage view shows what is still open. 39 reference frameworks with just under 4,000 controls are loaded for mapping. A pack documents how requirements are covered; it is not a certification.
A dashboard shows a risk heatmap with inherent and residual layers, the top risks and treatment progress. When an assessment is published it becomes an immutable version, and later changes start a new version.
Switch between the qualitative view and a monetary view of the same assessment, with no data entered twice. The monetary view shows estimates of financial exposure in EUR as ranges. This is decision support, not an insurance or actuarial product.
A TypeScript monorepo with a Next.js web app, a PostgreSQL database and a separate calculation engine. The engine has no input or output of its own, must keep 100 percent branch coverage, and is checked against golden test cases on every build. Reference data counts are verified exactly in CI, and the test suite runs unit, integration and end to end tests. It runs as a Docker Compose stack. The interface is available in English and Greek.
Built with AI agents, reviewed by a security professional. I used both local models and third party ones. The agents make it faster to build, integrate and iterate; I set the requirements, review the result and own the security. The work was planned first (charter, roadmap, functional spec), then built task by task with role based agents and build failing checks that hold the code to the methodology's numbers. AI was used only to build the tool, never inside it.
Why build it at all: I build tools for my own use first, and building is how I learn. Security is a big part of my life, and I want to show from real practice that a small builder can ship a secure app, and that security is more than passing an audit.
Stack
In development
In development and still being improved. All seven processes, the six stage workspace, compliance packs, bilingual help cards, an editable and versioned threat and measure library, the overview dashboard, exports and the financial view are built. ITSRM2+ is not for sale. Demos are given on request, preferably on a temporary instance with a fictional demo assessment.
Planned:
a structured, documented risk assessment, delivered with ITSRM2+, that ties regulation to concrete measures.
a methodical assessment with a public sector impact vocabulary and immutable published versions.
once the code is open source (planned), a guided workflow they can self-host that produces a register and reports from one assessment, with no row copying.
a clear view of the top risks, how treatment reduces them, and estimates of financial exposure.
A risk assessment tool aligned with the public ITSRM2 methodology, extended with AI and supply chain threats, compliance packs and exposure estimates.
Still under construction
The Tsakmak brand and this website are still being built, so some pages and details are not final yet. Thank you for your patience.