---
title: "Turn security findings into governed risks"
canonical: "https://support.appfire.com/space/RM/3714056435/Turn%20security%20findings%20into%20governed%20risks"
format: markdown
---
Security findings often start in tools used by security or engineering teams, while the work required to manage the resulting risk happens elsewhere. With Appfire LiveRisk, you can bring findings from connected security tools into Jira as signals and turn the relevant findings into governed risk work items.

This gives teams a way to move from a technical finding to an owned, assessed, and actionable risk without managing the risk separately from the work used to address it.

## When to use this approach

Use this workflow when findings from **Wiz or Snyk** need to be evaluated and managed as organizational risks.

> ✅ For example, a security team might identify several high-severity cloud findings in Wiz. Instead of tracking those findings separately in a spreadsheet or risk-management system, the team can bring them into LiveRisk, determine which findings represent a risk, and create a risk work item in Jira.

## How it works

The workflow looks like this:

**Security source → Signals → Risk → Assessment → Treatment → Monitoring**

1. **[Connect your security source](https://appfire.atlassian.net/wiki/spaces/RM/pages/3459219866)****.**  
A LiveRisk administrator connects Wiz or Snyk and configures which findings LiveRisk should ingest.
2. **[Review imported signals](https://appfire.atlassian.net/wiki/spaces/RM/pages/3459318006)****.**  
Findings appear as signals in LiveRisk. Filter or search them to identify the findings that should contribute to a risk.
3. **[Create a risk work item](https://appfire.atlassian.net/wiki/spaces/RM/pages/3459318006/Signals#Create-a-static-risk)****.**  
Select the relevant signals and create a risk. The signals remain linked to the risk work item, preserving the connection between the original findings and the governed risk.
4. **[Assess the risk](https://appfire.atlassian.net/wiki/spaces/RM/pages/3459121540)****.**  
Add the required risk details and determine its Inherent score. You can assess the risk manually or use LiveRisk's AI-assisted scoring.
5. **[Plan the treatment](https://appfire.atlassian.net/wiki/spaces/RM/pages/3459219901)****.**  
Decide how the risk should be treated and create the work required to reduce or otherwise address it. LiveRisk can also generate an AI-assisted treatment plan and mitigation tasks.
6. **[Monitor the risk](https://appfire.atlassian.net/wiki/spaces/RM/pages/3459547560)****.**  
Track the risk, its treatment work, scores, and linked signals from LiveRisk as mitigation progresses.

## Result

You now have a governed risk work item connected to the security findings that led to it, its owner, assessment, treatment decision, and mitigation work.

This creates traceability from the original technical findings to the work being performed to manage the resulting risk.