Anyone else find the risk assessment methodology too simplistic?

I’ve been deep in our Hyperproof sandbox for the last three weeks, trying to map our org’s risk framework for SOC 2 and GDPR, and I keep hitting the same wall: I find the built-in risk assessment methodology surprisingly one-dimensional. It feels like it’s designed for a world where risks are easily quantifiable on a simple scale, without much room for nuance or interconnected dependencies.

For example, when I’m trying to assess a risk like “third-party vendor data breach,” the tool basically asks me to assign:
* Likelihood: Low, Medium, High
* Impact: Low, Medium, High
That’s it. From there, it auto-calculates a “risk score” and slots it into a matrix. But in reality, for us, the *impact* varies wildly depending on *which* vendor, *what* data, and *where* our customers are located. The likelihood isn't just a static guess—it’s tied to our vendor’s own audit reports, which we track *in Hyperproof*! Shouldn't those be linked?

Here’s where I struggle:
* **No weightings:** I can’t assign more importance to, say, data integrity over availability if that’s our business reality.
* **No connection to controls:** The score doesn’t dynamically change as I map and test controls. It feels like a static starting point rather than a living assessment.
* **Persona headaches:** Trying to explain to our engineering teams why a risk is "high" based on this simplistic matrix leads to more debates about the tool than about the actual risk mitigation.

I came from a world of more granular risk registers (even a well-built Salesforce object structure, honestly), so maybe my expectations are too high? But for a platform that’s so strong on evidence collection and task management, this module feels like an afterthought.

My big question is: **Is anyone else using Hyperproof for complex risk scenarios and finding workarounds?** Have you just accepted the simplicity and managed the real logic in spreadsheets, or are you using custom fields and manual overrides to get the depth you need? I’d love to compare notes before we commit to this workflow for the long term.

— Emma