---
name: rt-risk-matrix
description: "Generate risk matrix (Likelihood x Impact) for all engagement findings. Plots each finding on 5x5 risk grid, calculates residual risk, and produces executive heat map visualization. Shows risk distribution and helps prioritize remediation. Uses CVSS scores as input and adds business context."
---

# rt-risk-matrix Skill

## Purpose and When to Use

The `rt-risk-matrix` skill generates a structured risk matrix for all findings produced during an RTExit engagement. It translates raw technical findings (CVSS scores, vulnerability classifications) into a business-contextualized risk view by plotting each finding on a 5x5 Likelihood x Impact grid, calculating residual risk scores, and producing an executive-ready heat map visualization.

Use this skill when:

- An engagement is complete or near-complete and findings need to be prioritized for the client.
- The client requires an executive summary with visual risk communication (heat map).
- You need to calculate residual risk after applying existing or proposed controls.
- Remediation prioritization is needed across a large set of heterogeneous findings.
- A risk register deliverable is required as part of the reporting package.

---

## Step-by-Step Workflow

### Step 1: Gather Findings Input

Collect all findings from the engagement. Accepted input formats:

- JSON findings export from RTExit pipeline (`findings.json`)
- CVSS vector strings (v3.0 or v3.1) per finding
- Manual finding entries with title, description, likelihood, and impact ratings

Each finding should include at minimum:

- Finding ID or title
- CVSS base score (or manual likelihood/impact values)
- Affected asset or component
- Existing controls (if any, for residual risk calculation)

### Step 2: Map CVSS to Likelihood and Impact

The skill decomposes CVSS scores into the two matrix axes:

| CVSS Range | Risk Level | Matrix Value |
|------------|------------|--------------|
| 9.0 - 10.0 | Critical   | 5            |
| 7.0 - 8.9  | High       | 4            |
| 4.0 - 6.9  | Medium     | 3            |
| 2.0 - 3.9  | Low        | 2            |
| 0.0 - 1.9  | Informational | 1         |

Likelihood derives from CVSS Attack Vector, Attack Complexity, and Privileges Required sub-scores. Impact derives from Confidentiality, Integrity, and Availability impact sub-scores.

If CVSS is unavailable, prompt for manual 1-5 ratings on each axis.

### Step 3: Plot the 5x5 Risk Grid

Each finding is placed on the grid using coordinates (Likelihood, Impact). The resulting heat map zones are:

```
Impact
  5 | MED  HIGH  CRIT  CRIT  CRIT
  4 | LOW  MED   HIGH  CRIT  CRIT
  3 | LOW  LOW   MED   HIGH  CRIT
  2 | LOW  LOW   LOW   MED   HIGH
  1 | LOW  LOW   LOW   LOW   MED
      1     2     3     4     5   --> Likelihood
```

Color zones:
- CRIT (red): Immediate action required
- HIGH (orange): Action within sprint/week
- MED (yellow): Action within release cycle
- LOW (green): Accept or defer

### Step 4: Calculate Residual Risk

For each finding, apply existing controls to reduce the inherent risk:

- Identify compensating controls from asset inventory or client input.
- Apply control effectiveness rating (None / Partial / Effective).
- Recalculate likelihood and/or impact after control application.
- Plot residual risk position on a second overlay of the same grid.

Residual risk score formula:

```
Residual Risk = Inherent Risk x (1 - Control Effectiveness %)
```

Control effectiveness mappings:

| Control State | Effectiveness |
|---------------|---------------|
| None          | 0%            |
| Partial       | 30%           |
| Effective     | 60%           |
| Strong        | 80%           |

### Step 5: Produce Heat Map Visualization

Generate a text-based or exportable heat map suitable for the report:

- ASCII grid for inline report embedding.
- Finding IDs annotated at their grid coordinates.
- Separate overlays for inherent and residual risk.
- Legend with finding ID to title mapping.

### Step 6: Generate Risk Distribution Summary

Produce a summary table showing finding counts per risk zone:

```
Zone         | Inherent Count | Residual Count | Delta
-------------|----------------|----------------|------
Critical     | X              | X              | -X
High         | X              | X              | -X
Medium       | X              | X              | -X
Low          | X              | X              | -X
```

### Step 7: Output Remediation Priority List

Sort all findings by risk score (descending) and output a prioritized remediation list:

- Finding ID, title, risk zone, recommended action, and suggested timeline.
- Flag any findings where residual risk remains Critical after controls.

---

## Integration with RTExit Scripts and Other Skills

### RTExit Script Integration

- `findings.json` — primary input; produced by the main RTExit evidence collection pipeline.
- `asset-inventory.json` — used to identify existing controls per asset for residual risk calculation.
- `report-builder` script — consumes the risk matrix output (`risk-matrix.json`) to embed the heat map and priority table in the final report.
- `cvss-calculator` utility — invoked automatically if CVSS vectors are present and need decomposition.

### Skill Dependencies and Handoffs

| Skill | Relationship |
|-------|-------------|
| `rt-findings-classifier` | Run before this skill to ensure findings are categorized and CVSS-scored. |
| `rt-executive-summary` | Consumes the heat map and risk distribution table produced by this skill. |
| `rt-remediation-roadmap` | Ingests the prioritized finding list to build a phased remediation plan. |
| `rt-report-builder` | Embeds all outputs from this skill into the deliverable report. |

Recommended skill execution order:

```
rt-findings-classifier -> rt-risk-matrix -> rt-remediation-roadmap -> rt-executive-summary -> rt-report-builder
```

---

## Example Outputs and Interactions

### Example 1: Basic Invocation

User prompt:
> Run the risk matrix for this engagement. Findings are in findings.json.

Skill response:
> Loading 14 findings from findings.json. Mapping CVSS scores to likelihood/impact axes.
> Plotting 5x5 risk grid... done.
> Calculating residual risk using controls from asset-inventory.json... done.
> Risk distribution: Critical: 3, High: 5, Medium: 4, Low: 2.
> Heat map and priority list ready. Exporting risk-matrix.json and risk-heatmap.txt.

### Example 2: Manual Rating Input

When CVSS scores are absent, the skill prompts:

> Finding: "Unencrypted backup storage"
> No CVSS score found. Please rate:
> - Likelihood (1=Rare, 2=Unlikely, 3=Possible, 4=Likely, 5=Almost Certain): 3
> - Impact (1=Negligible, 2=Minor, 3=Moderate, 4=Major, 5=Catastrophic): 5
> Inherent risk zone: CRITICAL (3x5=15). Existing controls? (None/Partial/Effective/Strong): Partial
> Residual risk zone: HIGH (adjusted score: 10.5).

### Example 3: Heat Map Output (ASCII)

```
         RISK HEAT MAP - ACME Corp Engagement (2026-05-31)
         Inherent Risk | O = finding location

Impact
  5 |  .    .    F04  F01  F03
  4 |  .    F12  F07  F02  .
  3 |  F14  F11  F08  F05  .
  2 |  F13  .    F10  F09  .
  1 |  .    .    .    .    F06
       1    2    3    4    5    Likelihood

Legend:
F01 - SQL Injection in login endpoint         [CRITICAL]
F02 - Default credentials on admin panel      [CRITICAL]
F03 - Remote code execution via file upload   [CRITICAL]
...
```

### Example 4: Prioritized Remediation List Output

```
Priority | ID  | Title                              | Zone     | Action          | Timeline
---------|-----|------------------------------------|----------|-----------------|----------
1        | F01 | SQL Injection in login endpoint    | Critical | Patch & retest  | Immediate
2        | F03 | RCE via file upload                | Critical | Patch & retest  | Immediate
3        | F02 | Default credentials on admin panel | Critical | Rotate & harden | 24 hours
4        | F05 | Outdated TLS configuration         | High     | Update config   | 1 week
...
```

---

## Practical Usage Tips

- Run `rt-findings-classifier` first to ensure all findings have valid CVSS scores before invoking this skill. Missing scores cause manual prompting which slows execution.

- When clients have strong existing controls, request the control inventory upfront. Residual risk often shifts the priority conversation significantly in executive presentations.

- For engagements with more than 20 findings, group findings by asset or finding category before plotting. Overcrowded grids lose readability in executive reports.

- Always produce both inherent and residual heat maps. The delta between the two maps is often the most compelling visual for demonstrating the value of existing security investments.

- If a finding remains Critical after all controls are applied (residual risk still Critical), flag it explicitly in the executive summary as an unmitigated critical exposure requiring immediate escalation.

- The ASCII heat map is suitable for markdown reports and terminal output. For formal PDF deliverables, pass the `risk-matrix.json` output to the `rt-report-builder` skill which renders a styled visual version.

- Business context matters. After the technical risk calculation, review each Critical and High finding with the client's business impact in mind. A Critical technical finding on a non-production, air-gapped system may be re-rated once business context is applied. Document any manual overrides with justification.

- Save `risk-matrix.json` to the engagement archive. It serves as the baseline for future engagements, allowing trend analysis and control improvement tracking over time.
