Riskamy vs SimpleRisk
Both run on your own servers. One is a free core you add paid Extras to; the other includes everything and runs the program for you.
Updated 10 October 2026
SimpleRisk is a free, open-source GRC core, with email reminders, workflows, incident management, spreadsheet import and AI sold as paid Extras, renewed every year. Riskamy includes all of that in one flat fee, and runs the risk program itself. Tag an incident and the score moves, the owner is asked to reassess, reminders and escalations follow, and leadership gets a written AI briefing, using the model you choose, including one that runs fully offline.
Side by side
| Riskamy | SimpleRisk | |
|---|---|---|
| What it is | Enterprise risk management that runs itself | An open-source GRC core (Mozilla Public License 2.0) with paid Extras |
| Deployment | Self-hosted on your servers or cloud account | Self-hosted (install script, VM image or Docker), or hosted by SimpleRisk |
| Offline | Connect a model on your own hardware and nothing leaves your network | Paid Extras need SimpleRisk’s licensing server to be reachable. Fully offline use is not documented |
| When an incident happens | Tag it and the risk score updates straight away; owners past appetite are asked to reassess | Incident management is a Premium paid Extra. Incidents link to risks; scores are adjusted by hand |
| Chasing | Reminders and escalation to a manager, on your schedule, included | Review dates by risk level. Email reminders and workflows are paid Extras; without them, SimpleRisk says, “updates happen quietly” |
| AI | AI briefings and plain-English questions, with Claude, OpenAI, DeepSeek or an offline model, included | A paid AI Extra for FAIR analysis and control-to-document matching |
| Getting started | Upload your spreadsheet, approve the mapping, switch the automations on. Migration is included | Spreadsheet import is a paid Extra, for CSV files |
| Pricing | One flat fee a year. Everything included, with no limits on users, risks, registers or instances | Free core. Extras billed every year, individually or in packages |
Why choose Riskamy over SimpleRisk
- Everything is in the fee. Reminders, escalations, incidents, spreadsheet import, AI briefings and every upgrade are included, not separate Extras to buy, license and renew.
- The risk program runs itself. Incidents move scores, owners are asked to reassess, reminders and escalations follow, without anyone building workflows first.
- The briefing is already written. Leadership gets a plain-English summary of what rose, what fell, who is late and what needs a decision.
- Built for enterprise risk. Owners across operations, finance, compliance and technology work in plain English, and every action is on record.
- Start from your spreadsheet. Bring the register you already have; we map it with you and you approve each step.
Switching from another risk tool? Show us the order form and take 66% off.
What SimpleRisk offers
- An open-source core under the Mozilla Public License 2.0, free to run, with unlimited users.
- Six risk scoring methods: Classic, CVSS, DREAD, OWASP, Custom and Contributing Risk.
- Paid Extras including email notifications, workflows, incident management, import and export, and AI.
- Self-hosted or SimpleRisk-hosted deployment, with published pricing.
Frequently asked questions
Is SimpleRisk free?
Its core is free and open source under the Mozilla Public License 2.0. Email reminders, workflows, incident management, spreadsheet import and AI are paid Extras, billed every year.
Does SimpleRisk update risk scores when an incident happens?
Not automatically. Incident management is a paid Extra, and SimpleRisk’s documentation describes adjusting a linked risk’s score as a manual step. In Riskamy, tagging an incident moves the score and asks the owner to reassess.
Can SimpleRisk run offline?
SimpleRisk does not document fully offline use. Its paid Extras check licences with SimpleRisk’s licensing server, so that server has to be reachable.
What does Riskamy’s fee include?
Everything: unlimited users, risks, registers, incidents and instances, AI briefings, all upgrades and new features, and migrating the register you use today.
Sources
Facts about SimpleRisk come from its own website, documentation and code repository, checked on 10 October 2026. If anything here is out of date, email [email protected] and we will correct it. SimpleRisk is a trademark of its owner; Riskamy is not affiliated with it.
- SimpleRisk pricing and Extras
- SimpleRisk licence
- SimpleRisk deployment
- SimpleRisk registration and licensing
- SimpleRisk risk review cadence
- SimpleRisk Email Notification Extra
- SimpleRisk: from incident to risk and back
- SimpleRisk AI Extra
- SimpleRisk Import-Export Extra
- SimpleRisk scoring methods
See it on your own register. Bring the spreadsheet you use today.
Book a demo