Use bowtie analysis to map cyber risk events, threats, preventive controls, consequences and mitigating controls. BowTie Risk is available for Mac, iPad and iPhone and can be used offline.
Used by risk professionals across 40 countries.
BowTie Risk shows a cybersecurity risk event, the threats and preventive controls that lead to it, and the consequences and mitigating controls that follow.
The diagram provides a common reference for technical analysis, risk treatment, control review and governance discussions.
Learn how a bowtie diagram works →
Malware encrypts or prevents access to organisational systems and data.
Deceptive communications are used to obtain information, credentials or unauthorised access.
Authorised users intentionally or unintentionally compromise systems, information or security.
A cyber incident involving a supplier, service provider or supply-chain dependency affects the organisation.
Personal, confidential or sensitive information is accessed or disclosed without authorisation.
Cyber activity disrupts or degrades access to systems, applications or digital services.
Cybersecurity risk assessments can contain sensitive information about threats, vulnerabilities, controls and potential consequences. BowTie Risk can be used fully offline, with assessment files stored locally on the device or in storage locations available to your organisation. No BowTie Risk cloud account is required.
NISTIR 8170 uses a bow-tie risk diagram to illustrate how the Cybersecurity Framework functions balance preventive and reactive activities. The current NIST Cybersecurity Framework is organised around Govern, Identify, Protect, Detect, Respond and Recover. Bowtie analysis can be used alongside this structure to document risk pathways and controls.
For ISO/IEC 27001, bowtie analysis can support risk assessment and risk treatment activities by documenting threats, controls, consequences and treatment measures. Similarly, frameworks such as the Essential Eight and APRA CPS 234 can provide control or assurance context, while a bowtie diagram provides a visual representation of how controls relate to a defined risk event.
BowTie Risk can prepare a structured prompt for an external AI tool from a defined cyber event. The returned causes, controls and consequences can be reviewed, edited and imported into the assessment. AI processing is performed by the external AI service selected by the user.
Yes. BowTie Risk can export bowtie diagrams and risk assessment data for use in board, management, audit or other organisational reporting.
Available for Mac, iPad and iPhone.