Every tool from The Value Chain Risk Institute, free to use. Our methods are open, so you can check how every result is reached. Most tools run entirely in your browser and upload nothing.
Score a vendor's, or your own, security posture with the open VCRI method: published rubrics and weights, so anyone can check the arithmetic.
In your browser · free · CC BY 4.0
Turn BeaconScore exports into an examiner-style report with an inherent risk profile and maturity graphs, in the form bank examiners know.
In your browser · free
Collect evidence from the security tools you already run and get a sealed, scored evidence package. Everything runs on your machines.
Open source · beta
Write the user security manual the CRA requires (Annex II), on the Cyber Manual Movement template. Import an SBOM, export JSON or PDF.
In your browser · nothing uploaded · CC BY 4.0
Derive context components, persons and zones from your product's functions, attach conditions of use, and get every diagram from one picture.
In your browser · nothing uploaded
Build the cybersecurity risk assessment the CRA requires (Annex VII), as a companion to the Cyber Manual.
In your browser · nothing uploaded
List everything an AI agent depends on (model, harness, MCP servers, plugins, prompts, memory) as a CycloneDX AIBOM. One small, readable file that runs offline.
Open source · Apache-2.0
Judge whether an AI system can be trusted with what it reads, remembers and does: 7 dimensions, 40 questions, each scored 0 to 5.
Open framework · CC BY 4.0
These kits also live on our Community page, along with a guide to finding your local security groups.
Lock down your AI tools, vet your IT provider, and check where you stand. No budget or security team required.
Free
A tiered field guide for small water and electric utilities: three actions this week, resilience this quarter, and a build-it-yourself network sensor.
Free · open-source tools
A tiered field guide for community banks and credit unions, with a free or open-source tool mapped to every CIS Control.
Free · open-source tools
A tiered field guide for rural and community hospitals and clinics, with a free or open-source tool mapped to every CIS Control.
Free · open-source tools
The security and AI acronyms used across our guides, each explained without jargon.
Free
Our quarterly report on open-source supply-chain risk, with methodology and data.
Quarterly · open data
One declared number that says whether a facility's failure reaches the people around it, and how fast.
Reference
A concept demo mapping cyber-physical fragility by consequence severity and resilience maturity.
Concept demo
Tell us which security and compliance tools you run. The Beacon Collector learns to read the most-used tools first. Results are public.
Two minutes
Source code and data: github.com/value-chain-risk-institute. Questions or a tool you'd like to see: info@valuechainrisk.org.