No security team fixes everything the day it is found. Some risks get accepted — a compensating control is already in place, a fix is scheduled for the next change window, the asset is being retired anyway. That is legitimate, and necessary. The problem is almost never the decision to accept a risk. It is where that decision goes to die.
The challenge: where accepted risk goes to die
An accepted risk is a decision, and a decision needs three things: an owner, a reason, and a date to look at it again. Most risk acceptance is recorded in none of them. It lives in a spreadsheet cell, a closed ticket, or a chat thread — somewhere nobody re-reads until an auditor asks, or until the thing you waved through turns into an incident.
Ask the hard questions of a typical risk register and it falls apart. Who accepted this, and were they entitled to? On what evidence? When is it due for review — or has it quietly become permanent? And the most dangerous question of all: what happens if something you accepted as low risk suddenly starts being exploited in the wild? If the honest answer is "nothing, until someone happens to notice", then your exception has become a blind spot with a paper trail that doesn't hold up. Auditors know this, which is why a weak risk-acceptance process is a perennial finding against the ACSC Information Security Manual (ISM), ISO 27001 and SOC 2.
An accepted risk is a decision, and a decision needs three things: an owner, a reason, and a date to look at it again.
What's new: risk decisions as accountable records
TONK, our external attack surface management (EASM) platform, now treats a risk decision as a first-class, accountable record rather than a note in the margin. When you have genuinely mitigated a finding another way, an analyst can apply a compensating-control demotion that lowers its action-urgency — without hiding the finding or pretending it is fixed. The technical severity does not change; you are adjusting how urgently to act, not rewriting the facts.
Every demotion carries its accountability with it: the person responsible, the evidence and justification behind the decision, and — where it matters — a mandatory review-by date, so an exception can never silently become permanent. Most importantly, the decision stays alive to the threat landscape. If a demoted finding later appears on the United States Cybersecurity and Infrastructure Security Agency's Known Exploited Vulnerabilities (KEV) catalogue, TONK forces it back for re-review instead of leaving it suppressed. The risk you accepted yesterday is re-opened the moment the world changes its mind about it.
And when the auditor does ask, the answer is one export. A Risk Waiver Report lays out the full register — active, expired and revoked demotions, each with its owner, evidence and expiry — so your risk-acceptance process is something you can hand over, not something you have to reconstruct.
Key capabilities
- Accountable demotions — lower a finding's urgency without downgrading or hiding it; the person who decided is on the record.
- Evidence and expiry — capture why the risk was accepted and when to look again; no permanent, silent exceptions.
- Threat-aware re-review — a demoted finding that becomes actively exploited (CISA KEV) is automatically forced back for review.
- Severity preserved — the technical severity never changes; you adjust urgency, not the facts of the finding.
- Audit-ready register — the complete waiver history, active, expired and revoked, in one exportable report.
Who benefits
Risk owners, security managers and compliance officers benefit directly, because a defensible risk-acceptance process is exactly what their frameworks demand. The ACSC ISM, the ASD Essential Eight, APRA CPS 234, the Security of Critical Infrastructure (SOCI) Act, ISO 27001 and SOC 2 all expect accepted risk to be owned, evidenced and periodically reviewed — not parked indefinitely.
How it works
Accepting a risk properly is part of the normal workflow:
- Open a finding you have mitigated another way and apply a compensating-control demotion.
- Record the justification and evidence, and set a review-by date where one is required.
- The finding's urgency drops, but it stays visible — and re-surfaces automatically if it becomes actively exploited.
- Export the Risk Waiver Report whenever you need to show the full register.
Getting started
Compensating-control demotions and the Risk Waiver Report are available now to TONK clients. Log in to your dashboard to review your risk register, or schedule a demo to see how it works on your estate.