SimpleRisk 20260820-001 — A New Home Page, a Rebuilt Compliance Core, AI Grounded in Your Program, and a Major Security Pass 

This is the largest SimpleRisk release in some time. It is also a catch-up: it brings generally available instances forward from 20260519-001, combining three release candidates into one shipment. If you are upgrading from 20260519-001, everything described here is new to you.

A Home page that tells you where you stand. SimpleRisk now opens on a Home dashboard instead of dropping you into a module. It carries a Getting Started onboarding checklist for new instances and sits alongside a redesigned, consistent set of Risk, Compliance, Governance and Incident dashboards. The layout is yours to arrange — move, resize and remove widgets, and restore the default whenever you want.

Control frameworks, tests and self-assessments, rebuilt. Define Control Frameworks is now a framework list with its controls alongside, and you can record which controls apply to each framework and why — then generate a Statement of Applicability and download it as an Excel workbook or a paginated PDF. Define Tests was rebuilt in parallel: tests can recur on a fixed calendar cadence instead of only counting down from the last run, audits can require approval before they close with rejection back for rework, and a single test can cover many controls rather than being duplicated across each one. Self-Assessments has been redesigned to run against the Secure Controls Framework.

AI that is grounded in your own program. This release adds an AI context graph and organization profile built from your own GRC data, and puts them to work: SimpleRisk can propose control tests for your review on the Define Tests page, with a human approving every suggestion before it becomes real. A new AI Capabilities Catalog lets you enable and discover each AI feature individually instead of turning everything on at once, and SimpleRisk now ships a Model Context Protocol server so an external AI assistant can connect and use read-only discovery tools — always gated by the same permissions that govern the underlying data. Ollama and other keyless local or self-hosted providers are fully supported, for teams that want AI without sending data to a hosted provider.

A substantial security pass. Across the three combined releases, permission enforcement was reviewed and tightened on more than forty individual views, API endpoints and internal data requests; output encoding was hardened throughout the application; state-changing actions now require an authenticated request rather than being reachable by following a link; credential handling was strengthened, including hashed API key storage and stronger multi-factor secrets; and outbound destinations for AI providers and workflow HTTP requests are now restricted to administrator-managed allow-lists. This work includes findings from an external penetration test, and third-party libraries were updated to versions addressing published advisories.

An upgrade path that works from anywhere. Several issues that could prevent SimpleRisk from upgrading are resolved, including a defect that stopped the one-click upgrade from running at all and problems affecting instances coming from much older releases. An instance on an older PHP version is now carried as far forward as that version supports rather than being refused outright, a damaged Upgrade Extra can repair itself, and database backups taken during an upgrade no longer depend on external tools. Extras now check compatibility with your installed release before installing, and report clearly when SimpleRisk needs upgrading first.

The Connectivity Visualizer was rebuilt on a much wider entity graph that now includes exceptions, audits, vulnerabilities and the risk and threat catalogues, with search and click-through exploration. The sign-in, password reset and multi-factor screens were redesigned, and a collapsing sidebar gives long pages more room. Customers with the Customization Extra can replace the SimpleRisk logo and tagline with their own and publish a system use notice on the login screen — enough to satisfy access-control requirements such as NIST 800-53 AC-8. Failed outbound emails now surface as in-app notifications instead of failing silently. Custom language files can override only the strings you want rather than carrying the full list on every upgrade. There is also a new optional demonstration mode for anyone running a shared, publicly accessible instance.

A broad round of reliability fixes lands across questionnaires and assessments, imports and exports, sign-in and multi-factor authentication, governance and compliance views, and background document processing. Two defects that silently discarded data are fixed: custom field values lost when editing a framework or control, and a preference discarded when saved alongside a language change. Both the User and Administrator Guides have been rewritten to focus on what you do rather than how it is built, with screenshots refreshed against the current interface.

The upgrade is delivered through the standard SimpleRisk upgrade flow, and as always we recommend backing up your database before applying any release in production. This release requires PHP 8.3 or newer — if your instance is on an earlier version, plan the PHP upgrade alongside it. Because Define Control Frameworks, Define Tests and Self-Assessments have all changed shape, we recommend walking those screens after upgrading so your team knows where things moved. If your instance restricts outbound traffic, note that Extra and release information is now retrieved from updates.simplerisk.com.