Allotrope — the risk-intelligence umbrella on vCISO Lite

What changed

Allotrope is the risk-intelligence umbrella on vCISO Lite. One data model, three lenses, one home for the three forward-looking risk products that used to live scattered across the platform. Full methodology for Refraction is in the DC-TPIR executive brief and academic paper; the KRI deep-dives are in the Continuous Indicators series and the “Why your KRIs stopped predicting anything” post.

Umbrella

Three forward-looking risk products that used to live scattered across the platform now share one data model and one home in the nav.

Refraction

Dependency-Centric Third-Party Incident Response. Vendor exposure priced in dollars before an incident lands, combining dark-web signal, threat-intel feeds, and your vendor concentration to surface which relationships are most likely to move next.

Keystone

Operational Resilience Engine. Which functions fall over first, what the loss looks like at each severity, who's downstream. A single-point-of-failure surfaces whether it's a person, a vendor, or a facility. Maps to DORA Art. 8, NYDFS §500.16(a)(2), and ISO 22301 §8.2.2.

Continuous Indicators

The KRI engine with real thresholds and triggered response, wired into the rest of the platform rather than the quarterly-review theater.

Cross-connects

A Continuous Indicator can trip a Keystone scenario; a Keystone scenario can raise a Refraction alert; a Refraction alert can update your vendor-risk register in real time.

Why it matters

Same underlying data model, three lenses on it. The umbrella lets us cross-connect the three: a Continuous Indicator can trip a Keystone scenario; a Keystone scenario can raise a Refraction alert; a Refraction alert can update your vendor-risk register in real time.

That composition is where the moat sits. The individual signals exist elsewhere; the mesh does not.

Availability

Shipping today on Business, Ultra, and Enterprise. No separate SKU; existing customers on those tiers see the umbrella in the nav automatically.

Related reading: Vendor Risk cluster and the DC-TPIR brief and paper.

Known limitations

Allotrope sits on Business tier and above. Lower tiers can still use the individual products but do not get the cross-connect wiring between them.

Refraction's dollar exposure requires vendors to be loaded in the vendor-risk register with contract value and criticality populated. A sparse register produces sparse exposure numbers.

Keystone scenarios run against your live dependency graph. Functions, processes, systems, and people without mapped dependencies will not appear in the resilience view until they're linked.