risk-assessment

name	risk-assessment
description	Security risk identification and analysis
license	MIT
compatibility	opencode
metadata	{"audience":"developers","category":"security"}

What I do

• Identify and categorize security risks
• Assess likelihood and impact of threats
• Prioritize risks for remediation
• Recommend mitigation strategies
• Track risk over time
• Quantify risk in business terms

When to use me

When evaluating security posture, planning security improvements, or conducting risk assessments for compliance.

Risk Assessment Framework

Risk Model

from enum import Enum
from datetime import datetime

class Likelihood(Enum):
    RARE = 1
    UNLIKELY = 2
    POSSIBLE = 3
    LIKELY = 4
    CERTAIN = 5

class Impact(Enum):
    NEGLIGIBLE = 1
    MINOR = 2
    MODERATE = 3
    MAJOR = 4
    CATASTROPHIC = 5

class RiskLevel(Enum):
    LOW = "low"
    MEDIUM = "medium"
    HIGH = "high"
    CRITICAL = "critical"

class Risk:
    def __init__(self, id: str, name: str, description: str):
        self.id = id
        self.name = name
        self.description = description
        self.likelihood = None
        self.impact = None
        self.current_controls = []
        self.residual_risk = None
        self.treated_risk = None
    
    def calculate_risk_level(self) -> RiskLevel:
        score = self.likelihood.value * self.impact.value
        
        if score >= 16:
            return RiskLevel.CRITICAL
        elif score >= 10:
            return RiskLevel.HIGH
        elif score >= 5:
            return RiskLevel.MEDIUM
        else:
            return RiskLevel.LOW
    
    def calculate_residual_risk(self) -> int:
        """Risk after current controls"""
        base_score = self.likelihood.value * self.impact.value
        control_effectiveness = sum(c.effectiveness for c in self.current_controls)
        reduction = min(control_effectiveness * 2, 80)  # Max 80% reduction
        return int(base_score * (100 - reduction) / 100)

Risk Assessment Process

class RiskAssessment:
    def __init__(self, name: str):
        self.name = name
        self.created_at = datetime.now()
        self.risks = []
        self.assets = []
    
    def add_asset(self, asset_id: str, name: str, value: str, 
                  classification: str):
        """Register an asset to protect"""
        self.assets.append({
            "id": asset_id,
            "name": name,
            "value": value,
            "classification": classification,
            "dependencies": []
        })
    
    def identify_risks(self) -> list:
        """Systematic risk identification"""
        risk_categories = [
            "Physical Security",
            "Network Security",
            "Application Security",
            "Data Security",
            "Operational Security",
            "Business Continuity"
        ]
        
        for category in risk_categories:
            risks = self._identify_category_risks(category)
            self.risks.extend(risks)
        
        return self.risks
    
    def () -> :
        
        templates = {
            : [
                (, , ),
                (, , ),
                (, , ),
                (, , ),
            ],
            : [
                (, , ),
                (, , ),
                (, , ),
            ]
        }
        
        risks = []
         risk_id, name, desc  templates.get(category, []):
            risk = Risk(risk_id, name, desc)
            risks.append(risk)
        
         risks
    
     ():
        
         risk  .risks:
             risk. == risk_id:
                risk.likelihood = likelihood
                risk.impact = impact
                risk.residual_risk = risk.calculate_residual_risk()
                 risk
        
         ValueError()
    
     () -> :
        
         (.risks, 
                     key= r: r.calculate_risk_level().value,
                     reverse=)

Risk Treatment

class RiskTreatment:
    def __init__(self):
        self.treatments = []
    
    def recommend_treatment(self, risk: Risk) -> dict:
        """Recommend mitigation strategy"""
        risk_level = risk.calculate_risk_level()
        
        if risk_level == RiskLevel.CRITICAL:
            treatment = "mitigate"
            timeline = "immediate"
            options = [
                "Implement preventive controls",
                "Deploy detection mechanisms",
                "Transfer risk through insurance"
            ]
        elif risk_level == RiskLevel.HIGH:
            treatment = "mitigate"
            timeline = "within 30 days"
            options = [
                "Enhance existing controls",
                "Add monitoring",
                "Implement compensating controls"
            ]
        elif risk_level == RiskLevel.MEDIUM:
            treatment = "accept"  # with monitoring
            timeline = "within 90 days"
            options = [
                "Accept with monitoring",
                "Implement partial mitigation"
            ]
        else:
            treatment = "accept"
            timeline = "as scheduled"
            options = ["Accept risk"]
        
        return {
            "risk_id": risk.id,
            "recommended_treatment": treatment,
            "timeline": timeline,
            : options,
            : ._calculate_cost_benefit(risk, options)
        }
    
     () -> :
        
        annual_loss_expectancy = ._calculate_ALE(risk)
        
         {
            : annual_loss_expectancy,
            : ,  
            :   
        }
    
     () -> :
        
         risk.likelihood.value * risk.impact.value * 

Continuous Risk Monitoring

class RiskMonitor:
    def __init__(self):
        self.risk_register = {}
    
    def track_risk(self, risk: Risk):
        """Track risk over time"""
        if risk.id not in self.risk_register:
            self.risk_register[risk.id] = []
        
        self.risk_register[risk.id].append({
            "timestamp": datetime.now(),
            "likelihood": risk.likelihood,
            "impact": risk.impact,
            "residual_risk": risk.residual_risk,
            "controls": risk.current_controls
        })
    
    def detect_risk_change(self, risk_id: str) -> dict:
        """Detect significant risk changes"""
        history = self.risk_register.get(risk_id, [])
        if len(history) < 2:
            return {"changed": False}
        
        current = history[-1]
        previous = history[-2]
        
        if current["residual_risk"] > previous["residual_risk"] * 1.2:
            return {
                "changed": ,
                : ,
                : current[] - previous[]
            }
        
         {: }
    
     () -> :
        
         {
            : (.risk_register),
            : ,
            : ,
            : ,
            : []
        }