From control checks to risk questions
Why evidence needs business context before it becomes a useful candidate risk statement.
A control check can tell us that an account is still active or a resource is publicly readable. That observation matters. But it does not, by itself, explain what the business stands to lose.
We need context. Which service depends on that resource? What is the service meant to achieve? Who could act on the observed condition, and what could happen if they do?
Start with evidence
Consider a software release service. One source says external pull requests run on its signing worker. Another says an active production signing key is available to every job on that worker.
The business objective is to deliver software authorized by the release owner.
Together, those observations support a candidate scenario: untrusted code might use the signing key to make unauthorized software appear legitimate. Neither record alone tells that whole story.
A candidate is not a confirmed finding
That scenario does not prove a compromise occurred. Isolation, approval gates or restrictions missing from our evidence could change the conclusion.
A useful pipeline preserves those questions alongside the statement. It keeps observed facts separate from assumptions and possible consequences.
The newer discovery experiment uses an LLM to propose scenarios and a second pass to challenge them. Code checks citations and output structure. A person still decides whether the evidence supports the scenario.
What continuous adds
As new records arrive, the pipeline should revisit its conclusions. A changed configuration may strengthen, weaken or contradict an earlier hypothesis.
Our discovery prototype demonstrates this with time windows of mock evidence. It does not yet provide always-on collection or stable risk identities across windows. Those remain engineering work.
Where this fits
GRC establishes the practice. GRC engineering makes parts of the practice executable. Risk engineering explores how that work can support identifying and, over time, assessing and managing uncertainty around business objectives.
Lab 01 starts with identification. No risk score or treatment decision is required to ask a better, evidence-backed question.