From 5e601a0ef0bb5e9f150b07f2facc52e7ee6e7f3f Mon Sep 17 00:00:00 2001
From: gearnode <bryan@frimin.fr>
Date: Sun, 30 Mar 2025 16:51:24 +0200
Subject: [PATCH] Add risk list and create risk

Signed-off-by: gearnode <bryan@frimin.fr>
---
 .../src/pages/organizations/Routes.tsx        |    4 +
 .../pages/organizations/risks/NewRiskPage.tsx |   29 +
 .../pages/organizations/risks/NewRiskView.tsx |  163 ++
 .../organizations/risks/RiskListPage.tsx      |   31 +
 .../organizations/risks/RiskListView.tsx      |  404 ++++
 .../NewRiskViewCreateRiskMutation.graphql.ts  |  192 ++
 .../RiskListViewDeleteMutation.graphql.ts     |  132 ++
 .../RiskListViewPaginationQuery.graphql.ts    |  309 +++
 .../RiskListViewQuery.graphql.ts              |  311 +++
 .../RiskListView_risks.graphql.ts             |  244 +++
 pkg/coredata/entity_type_reg.go               |    7 +-
 pkg/coredata/migrations/20250330T163200Z.sql  |    9 +
 pkg/coredata/risk.go                          |  198 ++
 pkg/coredata/risk_order_field.go              |   40 +
 pkg/probo/risk_service.go                     |  173 ++
 pkg/probo/service.go                          |    2 +
 pkg/server/api/console/v1/schema.graphql      |   75 +
 pkg/server/api/console/v1/schema/schema.go    | 1868 +++++++++++++++++
 pkg/server/api/console/v1/types/risk.go       |   54 +
 pkg/server/api/console/v1/types/types.go      |   50 +
 pkg/server/api/console/v1/v1_resolver.go      |   97 +-
 21 files changed, 4384 insertions(+), 8 deletions(-)
 create mode 100644 apps/console/src/pages/organizations/risks/NewRiskPage.tsx
 create mode 100644 apps/console/src/pages/organizations/risks/NewRiskView.tsx
 create mode 100644 apps/console/src/pages/organizations/risks/RiskListPage.tsx
 create mode 100644 apps/console/src/pages/organizations/risks/RiskListView.tsx
 create mode 100644 apps/console/src/pages/organizations/risks/__generated__/NewRiskViewCreateRiskMutation.graphql.ts
 create mode 100644 apps/console/src/pages/organizations/risks/__generated__/RiskListViewDeleteMutation.graphql.ts
 create mode 100644 apps/console/src/pages/organizations/risks/__generated__/RiskListViewPaginationQuery.graphql.ts
 create mode 100644 apps/console/src/pages/organizations/risks/__generated__/RiskListViewQuery.graphql.ts
 create mode 100644 apps/console/src/pages/organizations/risks/__generated__/RiskListView_risks.graphql.ts
 create mode 100644 pkg/coredata/migrations/20250330T163200Z.sql
 create mode 100644 pkg/coredata/risk.go
 create mode 100644 pkg/coredata/risk_order_field.go
 create mode 100644 pkg/probo/risk_service.go
 create mode 100644 pkg/server/api/console/v1/types/risk.go

diff --git a/apps/console/src/pages/organizations/Routes.tsx b/apps/console/src/pages/organizations/Routes.tsx
index 3afe197f7..a8bc6bc21 100644
--- a/apps/console/src/pages/organizations/Routes.tsx
+++ b/apps/console/src/pages/organizations/Routes.tsx
@@ -22,6 +22,8 @@ import { UpdatePolicyPage } from "./policies/UpdatePolicyPage";
 import { VendorListPage } from "./vendors/VendorListPage";
 import { VendorPage } from "./vendors/VendorPage";
 import { MitigationNewPage } from "./mitigations/MitigationNewPage";
+import { RiskListPage } from "./risks/RiskListPage";
+import { NewRiskPage } from "./risks/NewRiskPage";
 
 export function OrganizationsRoutes() {
   return (
@@ -53,6 +55,8 @@ export function OrganizationsRoutes() {
           path="policies/:policyId/update"
           element={<UpdatePolicyPage />}
         />
+        <Route path="risks" element={<RiskListPage />} />
+        <Route path="risks/new" element={<NewRiskPage />} />
         <Route path="settings" element={<SettingsPage />} />
         <Route path="*" element={<NotFoundPage />} />
       </Route>
diff --git a/apps/console/src/pages/organizations/risks/NewRiskPage.tsx b/apps/console/src/pages/organizations/risks/NewRiskPage.tsx
new file mode 100644
index 000000000..6aeda728b
--- /dev/null
+++ b/apps/console/src/pages/organizations/risks/NewRiskPage.tsx
@@ -0,0 +1,29 @@
+import { PageTemplateSkeleton } from "@/components/PageTemplate";
+import { Suspense } from "react";
+import { lazy } from "@probo/react-lazy";
+import { useLocation } from "react-router";
+import { ErrorBoundaryWithLocation } from "../ErrorBoundary";
+
+const NewRiskView = lazy(() => import("./NewRiskView"));
+
+export function NewRiskViewSkeleton() {
+  return (
+    <PageTemplateSkeleton>
+      <div className="space-y-2">
+        <div className="h-96 bg-muted animate-pulse rounded-lg" />
+      </div>
+    </PageTemplateSkeleton>
+  );
+}
+
+export function NewRiskPage() {
+  const location = useLocation();
+
+  return (
+    <Suspense key={location.pathname} fallback={<NewRiskViewSkeleton />}>
+      <ErrorBoundaryWithLocation>
+        <NewRiskView />
+      </ErrorBoundaryWithLocation>
+    </Suspense>
+  );
+}
diff --git a/apps/console/src/pages/organizations/risks/NewRiskView.tsx b/apps/console/src/pages/organizations/risks/NewRiskView.tsx
new file mode 100644
index 000000000..f54286c05
--- /dev/null
+++ b/apps/console/src/pages/organizations/risks/NewRiskView.tsx
@@ -0,0 +1,163 @@
+import { useState } from "react";
+import { useNavigate, useParams } from "react-router";
+import { ConnectionHandler, graphql, useMutation } from "react-relay";
+import {
+  Card,
+  CardContent,
+  CardHeader,
+  CardTitle,
+  CardDescription,
+} from "@/components/ui/card";
+import { Button } from "@/components/ui/button";
+import { Input } from "@/components/ui/input";
+import { Label } from "@/components/ui/label";
+import { Textarea } from "@/components/ui/textarea";
+import { useToast } from "@/hooks/use-toast";
+import { PageTemplate } from "@/components/PageTemplate";
+
+const createRiskMutation = graphql`
+  mutation NewRiskViewCreateRiskMutation(
+    $input: CreateRiskInput!
+    $connections: [ID!]!
+  ) {
+    createRisk(input: $input) {
+      riskEdge @prependEdge(connections: $connections) {
+        node {
+          id
+          name
+          description
+          createdAt
+          updatedAt
+        }
+      }
+    }
+  }
+`;
+
+export default function NewRiskView() {
+  const navigate = useNavigate();
+  const { organizationId } = useParams<{ organizationId: string }>();
+  const [name, setName] = useState("");
+  const [description, setDescription] = useState("");
+  const [isSubmitting, setIsSubmitting] = useState(false);
+  const { toast } = useToast();
+
+  const [commitMutation, isInFlight] = useMutation(createRiskMutation);
+
+  const handleSubmit = (e: React.FormEvent) => {
+    e.preventDefault();
+
+    if (!name.trim()) {
+      toast({
+        title: "Error",
+        description: "Please enter a name for the risk.",
+        variant: "destructive",
+      });
+      return;
+    }
+
+    setIsSubmitting(true);
+
+    const input = {
+      organizationId: organizationId!,
+      name,
+      description,
+    };
+
+    commitMutation({
+      variables: {
+        input,
+        connections: [
+          ConnectionHandler.getConnectionID(
+            organizationId!,
+            "RiskListView_risks"
+          ),
+        ],
+      },
+      onCompleted: (response, errors) => {
+        setIsSubmitting(false);
+        if (errors) {
+          console.error("Error creating risk:", errors);
+          toast({
+            title: "Error",
+            description: "Failed to create risk. Please try again.",
+            variant: "destructive",
+          });
+          return;
+        }
+
+        toast({
+          title: "Success",
+          description: "Risk created successfully!",
+        });
+
+        navigate(`/organizations/${organizationId}/risks`);
+      },
+      onError: (error) => {
+        setIsSubmitting(false);
+        console.error("Error creating risk:", error);
+        toast({
+          title: "Error",
+          description: "Failed to create risk. Please try again.",
+          variant: "destructive",
+        });
+      },
+    });
+  };
+
+  return (
+    <PageTemplate
+      title="Create Risk"
+      description="Add a new risk to your organization"
+    >
+      <Card className="max-w-2xl">
+        <CardHeader>
+          <CardTitle>Risk Details</CardTitle>
+          <CardDescription>
+            Enter the details of the risk you want to add to your organization.
+          </CardDescription>
+        </CardHeader>
+        <CardContent>
+          <form onSubmit={handleSubmit} className="space-y-6">
+            <div className="space-y-2">
+              <Label htmlFor="name">Name</Label>
+              <Input
+                id="name"
+                placeholder="Risk name"
+                value={name}
+                onChange={(e) => setName(e.target.value)}
+                required
+              />
+            </div>
+
+            <div className="space-y-2">
+              <Label htmlFor="description">Description</Label>
+              <Textarea
+                id="description"
+                placeholder="Describe the risk in detail"
+                value={description}
+                onChange={(e) => setDescription(e.target.value)}
+                rows={5}
+              />
+            </div>
+
+            <div className="flex justify-end gap-3">
+              <Button
+                type="button"
+                variant="outline"
+                onClick={() =>
+                  navigate(`/organizations/${organizationId}/risks`)
+                }
+              >
+                Cancel
+              </Button>
+              <Button type="submit" disabled={isInFlight || isSubmitting}>
+                {isInFlight || isSubmitting ? "Creating..." : "Create Risk"}
+              </Button>
+            </div>
+          </form>
+        </CardContent>
+      </Card>
+    </PageTemplate>
+  );
+}
diff --git a/apps/console/src/pages/organizations/risks/RiskListPage.tsx b/apps/console/src/pages/organizations/risks/RiskListPage.tsx
new file mode 100644
index 000000000..91bfd7b30
--- /dev/null
+++ b/apps/console/src/pages/organizations/risks/RiskListPage.tsx
@@ -0,0 +1,31 @@
+import { PageTemplateSkeleton } from "@/components/PageTemplate";
+import { Suspense } from "react";
+import { lazy } from "@probo/react-lazy";
+import { useLocation } from "react-router";
+import { ErrorBoundaryWithLocation } from "../ErrorBoundary";
+
+const RiskListView = lazy(() => import("./RiskListView"));
+
+export function RiskViewSkeleton() {
+  return (
+    <PageTemplateSkeleton>
+      <div className="space-y-2">
+        {[1, 2].map((i) => (
+          <div key={i} className="h-20 bg-muted animate-pulse rounded-lg" />
+        ))}
+      </div>
+    </PageTemplateSkeleton>
+  );
+}
+
+export function RiskListPage() {
+  const location = useLocation();
+
+  return (
+    <Suspense key={location.pathname} fallback={<RiskViewSkeleton />}>
+      <ErrorBoundaryWithLocation>
+        <RiskListView />
+      </ErrorBoundaryWithLocation>
+    </Suspense>
+  );
+}
diff --git a/apps/console/src/pages/organizations/risks/RiskListView.tsx b/apps/console/src/pages/organizations/risks/RiskListView.tsx
new file mode 100644
index 000000000..c407d2f98
--- /dev/null
+++ b/apps/console/src/pages/organizations/risks/RiskListView.tsx
@@ -0,0 +1,404 @@
+"use client";
+
+import {
+  graphql,
+  PreloadedQuery,
+  usePaginationFragment,
+  usePreloadedQuery,
+  useQueryLoader,
+  useMutation,
+} from "react-relay";
+import {
+  Suspense,
+  useCallback,
+  useEffect,
+  useState,
+  useTransition,
+} from "react";
+import type { RiskListViewQuery } from "./__generated__/RiskListViewQuery.graphql";
+import { useParams, useSearchParams } from "react-router";
+import { PageTemplate } from "@/components/PageTemplate";
+import { RiskViewSkeleton } from "./RiskListPage";
+import { RiskListViewPaginationQuery } from "./__generated__/RiskListViewPaginationQuery.graphql";
+import { RiskListView_risks$key } from "./__generated__/RiskListView_risks.graphql";
+import { Button } from "@/components/ui/button";
+import { Card, CardContent } from "@/components/ui/card";
+import { Link } from "react-router";
+import { Plus, Trash2 } from "lucide-react";
+import { useToast } from "@/hooks/use-toast";
+import {
+  Dialog,
+  DialogContent,
+  DialogDescription,
+  DialogFooter,
+  DialogHeader,
+  DialogTitle,
+} from "@/components/ui/dialog";
+import { RiskListViewDeleteMutation } from "./__generated__/RiskListViewDeleteMutation.graphql";
+
+const defaultPageSize = 25;
+
+const riskListViewQuery = graphql`
+  query RiskListViewQuery(
+    $organizationId: ID!
+    $first: Int
+    $after: CursorKey
+    $last: Int
+    $before: CursorKey
+  ) {
+    organization: node(id: $organizationId) {
+      id
+
+      ...RiskListView_risks
+        @arguments(first: $first, after: $after, last: $last, before: $before)
+    }
+  }
+`;
+
+const riskListFragment = graphql`
+  fragment RiskListView_risks on Organization
+  @refetchable(queryName: "RiskListViewPaginationQuery")
+  @argumentDefinitions(
+    first: { type: "Int" }
+    after: { type: "CursorKey" }
+    last: { type: "Int" }
+    before: { type: "CursorKey" }
+  ) {
+    risks(first: $first, after: $after, last: $last, before: $before)
+      @connection(key: "RiskListView_risks") {
+      __id
+      edges {
+        node {
+          id
+          name
+          description
+          createdAt
+          updatedAt
+        }
+      }
+      pageInfo {
+        hasNextPage
+        hasPreviousPage
+        startCursor
+        endCursor
+      }
+    }
+  }
+`;
+
+const deleteRiskMutation = graphql`
+  mutation RiskListViewDeleteMutation(
+    $input: DeleteRiskInput!
+    $connections: [ID!]!
+  ) {
+    deleteRisk(input: $input) {
+      deletedRiskId @deleteEdge(connections: $connections)
+    }
+  }
+`;
+
+function LoadAboveButton({
+  isLoading,
+  hasMore,
+  onLoadMore,
+}: {
+  isLoading: boolean;
+  hasMore: boolean;
+  onLoadMore: () => void;
+}) {
+  if (!hasMore) {
+    return null;
+  }
+
+  return (
+    <div className="flex justify-center mb-6">
+      <Button
+        variant="outline"
+        onClick={onLoadMore}
+        disabled={isLoading}
+        className="w-full"
+      >
+        {isLoading ? "Loading..." : "Load above"}
+      </Button>
+    </div>
+  );
+}
+
+function LoadBelowButton({
+  isLoading,
+  hasMore,
+  onLoadMore,
+}: {
+  isLoading: boolean;
+  hasMore: boolean;
+  onLoadMore: () => void;
+}) {
+  if (!hasMore) {
+    return null;
+  }
+
+  return (
+    <div className="flex justify-center mt-6">
+      <Button
+        variant="outline"
+        onClick={onLoadMore}
+        disabled={isLoading || !hasMore}
+        className="w-full"
+      >
+        {isLoading ? "Loading..." : "Load below"}
+      </Button>
+    </div>
+  );
+}
+
+function RiskListViewContent({
+  queryRef,
+}: {
+  queryRef: PreloadedQuery<RiskListViewQuery>;
+}) {
+  const data = usePreloadedQuery(riskListViewQuery, queryRef);
+  const [, setSearchParams] = useSearchParams();
+  const [, startTransition] = useTransition();
+  const { organizationId } = useParams<{ organizationId: string }>();
+  const { toast } = useToast();
+
+  // State for delete confirmation dialog
+  const [riskToDelete, setRiskToDelete] = useState<{
+    id: string;
+    name: string;
+  } | null>(null);
+  const [isDeleting, setIsDeleting] = useState(false);
+
+  // Setup delete mutation
+  const [commitDeleteMutation] =
+    useMutation<RiskListViewDeleteMutation>(deleteRiskMutation);
+
+  const {
+    data: risksConnection,
+    loadNext,
+    loadPrevious,
+    hasNext,
+    hasPrevious,
+    isLoadingNext,
+    isLoadingPrevious,
+  } = usePaginationFragment<
+    RiskListViewPaginationQuery,
+    RiskListView_risks$key
+  >(riskListFragment, data.organization);
+
+  const risks = risksConnection?.risks?.edges?.map((edge) => edge.node) || [];
+  const pageInfo = risksConnection?.risks?.pageInfo;
+  const connectionId = risksConnection?.risks?.__id;
+
+  // Handle delete risk
+  const handleDeleteRisk = useCallback(() => {
+    if (!riskToDelete || !connectionId) return;
+
+    setIsDeleting(true);
+
+    commitDeleteMutation({
+      variables: {
+        input: {
+          riskId: riskToDelete.id,
+        },
+        connections: [connectionId],
+      },
+      onCompleted: (_, errors) => {
+        setIsDeleting(false);
+        setRiskToDelete(null);
+
+        if (errors) {
+          console.error("Error deleting risk:", errors);
+          toast({
+            title: "Error",
+            description: "Failed to delete risk. Please try again.",
+            variant: "destructive",
+          });
+          return;
+        }
+
+        toast({
+          title: "Success",
+          description: "Risk deleted successfully.",
+        });
+      },
+      onError: (error) => {
+        setIsDeleting(false);
+        setRiskToDelete(null);
+        console.error("Error deleting risk:", error);
+        toast({
+          title: "Error",
+          description: "Failed to delete risk. Please try again.",
+          variant: "destructive",
+        });
+      },
+    });
+  }, [riskToDelete, connectionId, commitDeleteMutation, toast]);
+
+  return (
+    <PageTemplate
+      title="Risks"
+      actions={
+        <Button asChild>
+          <Link to={`/organizations/${organizationId}/risks/new`}>
+            <Plus className="mr-2 h-4 w-4" />
+            New Risk
+          </Link>
+        </Button>
+      }
+    >
+      <div className="space-y-6">
+        <LoadAboveButton
+          isLoading={isLoadingPrevious}
+          hasMore={hasPrevious}
+          onLoadMore={() => {
+            startTransition(() => {
+              setSearchParams((prev) => {
+                prev.set("before", pageInfo?.startCursor || "");
+                prev.delete("after");
+                return prev;
+              });
+              loadPrevious(defaultPageSize);
+            });
+          }}
+        />
+
+        <Card>
+          <CardContent className="p-0">
+            <div className="w-full overflow-auto">
+              <table className="w-full caption-bottom text-sm">
+                <thead className="[&_tr]:border-b">
+                  <tr className="border-b transition-colors hover:bg-muted/50 data-[state=selected]:bg-muted">
+                    <th className="h-12 px-4 text-left align-middle font-medium text-muted-foreground">
+                      Name
+                    </th>
+                    <th className="h-12 px-4 text-left align-middle font-medium text-muted-foreground">
+                      Description
+                    </th>
+                    <th className="h-12 px-4 text-left align-middle font-medium text-muted-foreground">
+                      Actions
+                    </th>
+                  </tr>
+                </thead>
+                <tbody className="[&_tr:last-child]:border-0">
+                  {risks.length === 0 ? (
+                    <tr className="border-b transition-colors hover:bg-muted/50 data-[state=selected]:bg-muted">
+                      <td
+                        colSpan={3}
+                        className="text-center p-4 align-middle text-muted-foreground"
+                      >
+                        No risks found. Create a new risk to get started.
+                      </td>
+                    </tr>
+                  ) : (
+                    risks.map((risk) => (
+                      <tr
+                        key={risk.id}
+                        className="border-b transition-colors hover:bg-muted/50 data-[state=selected]:bg-muted cursor-pointer"
+                      >
+                        <td className="p-4 align-middle font-medium">
+                          {risk.name}
+                        </td>
+                        <td className="p-4 align-middle">{risk.description}</td>
+                        <td className="p-4 align-middle">
+                          <Button
+                            variant="ghost"
+                            size="icon"
+                            onClick={(e) => {
+                              e.stopPropagation();
+                              setRiskToDelete({ id: risk.id, name: risk.name });
+                            }}
+                          >
+                            <Trash2 className="h-4 w-4 text-destructive" />
+                          </Button>
+                        </td>
+                      </tr>
+                    ))
+                  )}
+                </tbody>
+              </table>
+            </div>
+          </CardContent>
+        </Card>
+
+        <LoadBelowButton
+          isLoading={isLoadingNext}
+          hasMore={hasNext}
+          onLoadMore={() => {
+            startTransition(() => {
+              setSearchParams((prev) => {
+                prev.set("after", pageInfo?.endCursor || "");
+                prev.delete("before");
+                return prev;
+              });
+              loadNext(defaultPageSize);
+            });
+          }}
+        />
+
+        {/* Delete Confirmation Dialog */}
+        <Dialog
+          open={!!riskToDelete}
+          onOpenChange={(open) => !open && setRiskToDelete(null)}
+        >
+          <DialogContent>
+            <DialogHeader>
+              <DialogTitle>Are you sure?</DialogTitle>
+              <DialogDescription>
+                This will permanently delete the risk &quot;{riskToDelete?.name}
+                &quot;. This action cannot be undone.
+              </DialogDescription>
+            </DialogHeader>
+            <DialogFooter>
+              <Button
+                variant="outline"
+                onClick={() => setRiskToDelete(null)}
+                disabled={isDeleting}
+              >
+                Cancel
+              </Button>
+              <Button
+                onClick={handleDeleteRisk}
+                disabled={isDeleting}
+                variant="destructive"
+              >
+                {isDeleting ? "Deleting..." : "Delete"}
+              </Button>
+            </DialogFooter>
+          </DialogContent>
+        </Dialog>
+      </div>
+    </PageTemplate>
+  );
+}
+
+export default function RiskListView() {
+  const [searchParams] = useSearchParams();
+  const [queryRef, loadQuery] =
+    useQueryLoader<RiskListViewQuery>(riskListViewQuery);
+
+  const { organizationId } = useParams();
+
+  useEffect(() => {
+    const after = searchParams.get("after");
+    const before = searchParams.get("before");
+
+    loadQuery({
+      organizationId: organizationId!,
+      first: before ? undefined : defaultPageSize,
+      after: after || undefined,
+      last: before ? defaultPageSize : undefined,
+      before: before || undefined,
+    });
+  }, [loadQuery, organizationId]);
+
+  if (!queryRef) {
+    return <RiskViewSkeleton />;
+  }
+
+  return (
+    <Suspense fallback={<RiskViewSkeleton />}>
+      <RiskListViewContent queryRef={queryRef} />
+    </Suspense>
+  );
+}
diff --git a/apps/console/src/pages/organizations/risks/__generated__/NewRiskViewCreateRiskMutation.graphql.ts b/apps/console/src/pages/organizations/risks/__generated__/NewRiskViewCreateRiskMutation.graphql.ts
new file mode 100644
index 000000000..4c8139056
--- /dev/null
+++ b/apps/console/src/pages/organizations/risks/__generated__/NewRiskViewCreateRiskMutation.graphql.ts
@@ -0,0 +1,192 @@
+/**
+ * @generated SignedSource<<c3a526641ca53f4ef760eacadc5c3685>>
+ * @lightSyntaxTransform
+ * @nogrep
+ */
+
+/* tslint:disable */
+/* eslint-disable */
+// @ts-nocheck
+
+import { ConcreteRequest } from 'relay-runtime';
+export type CreateRiskInput = {
+  description: string;
+  name: string;
+  organizationId: string;
+};
+export type NewRiskViewCreateRiskMutation$variables = {
+  connections: ReadonlyArray<string>;
+  input: CreateRiskInput;
+};
+export type NewRiskViewCreateRiskMutation$data = {
+  readonly createRisk: {
+    readonly riskEdge: {
+      readonly node: {
+        readonly createdAt: string;
+        readonly description: string;
+        readonly id: string;
+        readonly name: string;
+        readonly updatedAt: string;
+      };
+    };
+  };
+};
+export type NewRiskViewCreateRiskMutation = {
+  response: NewRiskViewCreateRiskMutation$data;
+  variables: NewRiskViewCreateRiskMutation$variables;
+};
+
+const node: ConcreteRequest = (function(){
+var v0 = {
+  "defaultValue": null,
+  "kind": "LocalArgument",
+  "name": "connections"
+},
+v1 = {
+  "defaultValue": null,
+  "kind": "LocalArgument",
+  "name": "input"
+},
+v2 = [
+  {
+    "kind": "Variable",
+    "name": "input",
+    "variableName": "input"
+  }
+],
+v3 = {
+  "alias": null,
+  "args": null,
+  "concreteType": "RiskEdge",
+  "kind": "LinkedField",
+  "name": "riskEdge",
+  "plural": false,
+  "selections": [
+    {
+      "alias": null,
+      "args": null,
+      "concreteType": "Risk",
+      "kind": "LinkedField",
+      "name": "node",
+      "plural": false,
+      "selections": [
+        {
+          "alias": null,
+          "args": null,
+          "kind": "ScalarField",
+          "name": "id",
+          "storageKey": null
+        },
+        {
+          "alias": null,
+          "args": null,
+          "kind": "ScalarField",
+          "name": "name",
+          "storageKey": null
+        },
+        {
+          "alias": null,
+          "args": null,
+          "kind": "ScalarField",
+          "name": "description",
+          "storageKey": null
+        },
+        {
+          "alias": null,
+          "args": null,
+          "kind": "ScalarField",
+          "name": "createdAt",
+          "storageKey": null
+        },
+        {
+          "alias": null,
+          "args": null,
+          "kind": "ScalarField",
+          "name": "updatedAt",
+          "storageKey": null
+        }
+      ],
+      "storageKey": null
+    }
+  ],
+  "storageKey": null
+};
+return {
+  "fragment": {
+    "argumentDefinitions": [
+      (v0/*: any*/),
+      (v1/*: any*/)
+    ],
+    "kind": "Fragment",
+    "metadata": null,
+    "name": "NewRiskViewCreateRiskMutation",
+    "selections": [
+      {
+        "alias": null,
+        "args": (v2/*: any*/),
+        "concreteType": "CreateRiskPayload",
+        "kind": "LinkedField",
+        "name": "createRisk",
+        "plural": false,
+        "selections": [
+          (v3/*: any*/)
+        ],
+        "storageKey": null
+      }
+    ],
+    "type": "Mutation",
+    "abstractKey": null
+  },
+  "kind": "Request",
+  "operation": {
+    "argumentDefinitions": [
+      (v1/*: any*/),
+      (v0/*: any*/)
+    ],
+    "kind": "Operation",
+    "name": "NewRiskViewCreateRiskMutation",
+    "selections": [
+      {
+        "alias": null,
+        "args": (v2/*: any*/),
+        "concreteType": "CreateRiskPayload",
+        "kind": "LinkedField",
+        "name": "createRisk",
+        "plural": false,
+        "selections": [
+          (v3/*: any*/),
+          {
+            "alias": null,
+            "args": null,
+            "filters": null,
+            "handle": "prependEdge",
+            "key": "",
+            "kind": "LinkedHandle",
+            "name": "riskEdge",
+            "handleArgs": [
+              {
+                "kind": "Variable",
+                "name": "connections",
+                "variableName": "connections"
+              }
+            ]
+          }
+        ],
+        "storageKey": null
+      }
+    ]
+  },
+  "params": {
+    "cacheID": "ce3ac503734a6f0eb26f88813ed02858",
+    "id": null,
+    "metadata": {},
+    "name": "NewRiskViewCreateRiskMutation",
+    "operationKind": "mutation",
+    "text": "mutation NewRiskViewCreateRiskMutation(\n  $input: CreateRiskInput!\n) {\n  createRisk(input: $input) {\n    riskEdge {\n      node {\n        id\n        name\n        description\n        createdAt\n        updatedAt\n      }\n    }\n  }\n}\n"
+  }
+};
+})();
+
+(node as any).hash = "c0d8d1f046ed41c7a429c54b32358d3f";
+
+export default node;
diff --git a/apps/console/src/pages/organizations/risks/__generated__/RiskListViewDeleteMutation.graphql.ts b/apps/console/src/pages/organizations/risks/__generated__/RiskListViewDeleteMutation.graphql.ts
new file mode 100644
index 000000000..9a33faea6
--- /dev/null
+++ b/apps/console/src/pages/organizations/risks/__generated__/RiskListViewDeleteMutation.graphql.ts
@@ -0,0 +1,132 @@
+/**
+ * @generated SignedSource<<349d62a3a4ed3ea1d83c12f0c61437dd>>
+ * @lightSyntaxTransform
+ * @nogrep
+ */
+
+/* tslint:disable */
+/* eslint-disable */
+// @ts-nocheck
+
+import { ConcreteRequest } from 'relay-runtime';
+export type DeleteRiskInput = {
+  riskId: string;
+};
+export type RiskListViewDeleteMutation$variables = {
+  connections: ReadonlyArray<string>;
+  input: DeleteRiskInput;
+};
+export type RiskListViewDeleteMutation$data = {
+  readonly deleteRisk: {
+    readonly deletedRiskId: string;
+  };
+};
+export type RiskListViewDeleteMutation = {
+  response: RiskListViewDeleteMutation$data;
+  variables: RiskListViewDeleteMutation$variables;
+};
+
+const node: ConcreteRequest = (function(){
+var v0 = {
+  "defaultValue": null,
+  "kind": "LocalArgument",
+  "name": "connections"
+},
+v1 = {
+  "defaultValue": null,
+  "kind": "LocalArgument",
+  "name": "input"
+},
+v2 = [
+  {
+    "kind": "Variable",
+    "name": "input",
+    "variableName": "input"
+  }
+],
+v3 = {
+  "alias": null,
+  "args": null,
+  "kind": "ScalarField",
+  "name": "deletedRiskId",
+  "storageKey": null
+};
+return {
+  "fragment": {
+    "argumentDefinitions": [
+      (v0/*: any*/),
+      (v1/*: any*/)
+    ],
+    "kind": "Fragment",
+    "metadata": null,
+    "name": "RiskListViewDeleteMutation",
+    "selections": [
+      {
+        "alias": null,
+        "args": (v2/*: any*/),
+        "concreteType": "DeleteRiskPayload",
+        "kind": "LinkedField",
+        "name": "deleteRisk",
+        "plural": false,
+        "selections": [
+          (v3/*: any*/)
+        ],
+        "storageKey": null
+      }
+    ],
+    "type": "Mutation",
+    "abstractKey": null
+  },
+  "kind": "Request",
+  "operation": {
+    "argumentDefinitions": [
+      (v1/*: any*/),
+      (v0/*: any*/)
+    ],
+    "kind": "Operation",
+    "name": "RiskListViewDeleteMutation",
+    "selections": [
+      {
+        "alias": null,
+        "args": (v2/*: any*/),
+        "concreteType": "DeleteRiskPayload",
+        "kind": "LinkedField",
+        "name": "deleteRisk",
+        "plural": false,
+        "selections": [
+          (v3/*: any*/),
+          {
+            "alias": null,
+            "args": null,
+            "filters": null,
+            "handle": "deleteEdge",
+            "key": "",
+            "kind": "ScalarHandle",
+            "name": "deletedRiskId",
+            "handleArgs": [
+              {
+                "kind": "Variable",
+                "name": "connections",
+                "variableName": "connections"
+              }
+            ]
+          }
+        ],
+        "storageKey": null
+      }
+    ]
+  },
+  "params": {
+    "cacheID": "525011737d0920883b3942d2603dc31f",
+    "id": null,
+    "metadata": {},
+    "name": "RiskListViewDeleteMutation",
+    "operationKind": "mutation",
+    "text": "mutation RiskListViewDeleteMutation(\n  $input: DeleteRiskInput!\n) {\n  deleteRisk(input: $input) {\n    deletedRiskId\n  }\n}\n"
+  }
+};
+})();
+
+(node as any).hash = "4aee92e5abfd6733b44588bf01276560";
+
+export default node;
diff --git a/apps/console/src/pages/organizations/risks/__generated__/RiskListViewPaginationQuery.graphql.ts b/apps/console/src/pages/organizations/risks/__generated__/RiskListViewPaginationQuery.graphql.ts
new file mode 100644
index 000000000..21c80f118
--- /dev/null
+++ b/apps/console/src/pages/organizations/risks/__generated__/RiskListViewPaginationQuery.graphql.ts
@@ -0,0 +1,309 @@
+/**
+ * @generated SignedSource<<56b70bbecd785111cec0e7ff6ec2c226>>
+ * @lightSyntaxTransform
+ * @nogrep
+ */
+
+/* tslint:disable */
+/* eslint-disable */
+// @ts-nocheck
+
+import { ConcreteRequest } from 'relay-runtime';
+import { FragmentRefs } from "relay-runtime";
+export type RiskListViewPaginationQuery$variables = {
+  after?: string | null | undefined;
+  before?: string | null | undefined;
+  first?: number | null | undefined;
+  id: string;
+  last?: number | null | undefined;
+};
+export type RiskListViewPaginationQuery$data = {
+  readonly node: {
+    readonly " $fragmentSpreads": FragmentRefs<"RiskListView_risks">;
+  };
+};
+export type RiskListViewPaginationQuery = {
+  response: RiskListViewPaginationQuery$data;
+  variables: RiskListViewPaginationQuery$variables;
+};
+
+const node: ConcreteRequest = (function(){
+var v0 = {
+  "defaultValue": null,
+  "kind": "LocalArgument",
+  "name": "after"
+},
+v1 = {
+  "defaultValue": null,
+  "kind": "LocalArgument",
+  "name": "before"
+},
+v2 = {
+  "defaultValue": null,
+  "kind": "LocalArgument",
+  "name": "first"
+},
+v3 = {
+  "defaultValue": null,
+  "kind": "LocalArgument",
+  "name": "id"
+},
+v4 = {
+  "defaultValue": null,
+  "kind": "LocalArgument",
+  "name": "last"
+},
+v5 = [
+  {
+    "kind": "Variable",
+    "name": "id",
+    "variableName": "id"
+  }
+],
+v6 = [
+  {
+    "kind": "Variable",
+    "name": "after",
+    "variableName": "after"
+  },
+  {
+    "kind": "Variable",
+    "name": "before",
+    "variableName": "before"
+  },
+  {
+    "kind": "Variable",
+    "name": "first",
+    "variableName": "first"
+  },
+  {
+    "kind": "Variable",
+    "name": "last",
+    "variableName": "last"
+  }
+],
+v7 = {
+  "alias": null,
+  "args": null,
+  "kind": "ScalarField",
+  "name": "__typename",
+  "storageKey": null
+},
+v8 = {
+  "alias": null,
+  "args": null,
+  "kind": "ScalarField",
+  "name": "id",
+  "storageKey": null
+};
+return {
+  "fragment": {
+    "argumentDefinitions": [
+      (v0/*: any*/),
+      (v1/*: any*/),
+      (v2/*: any*/),
+      (v3/*: any*/),
+      (v4/*: any*/)
+    ],
+    "kind": "Fragment",
+    "metadata": null,
+    "name": "RiskListViewPaginationQuery",
+    "selections": [
+      {
+        "alias": null,
+        "args": (v5/*: any*/),
+        "concreteType": null,
+        "kind": "LinkedField",
+        "name": "node",
+        "plural": false,
+        "selections": [
+          {
+            "args": (v6/*: any*/),
+            "kind": "FragmentSpread",
+            "name": "RiskListView_risks"
+          }
+        ],
+        "storageKey": null
+      }
+    ],
+    "type": "Query",
+    "abstractKey": null
+  },
+  "kind": "Request",
+  "operation": {
+    "argumentDefinitions": [
+      (v0/*: any*/),
+      (v1/*: any*/),
+      (v2/*: any*/),
+      (v4/*: any*/),
+      (v3/*: any*/)
+    ],
+    "kind": "Operation",
+    "name": "RiskListViewPaginationQuery",
+    "selections": [
+      {
+        "alias": null,
+        "args": (v5/*: any*/),
+        "concreteType": null,
+        "kind": "LinkedField",
+        "name": "node",
+        "plural": false,
+        "selections": [
+          (v7/*: any*/),
+          (v8/*: any*/),
+          {
+            "kind": "InlineFragment",
+            "selections": [
+              {
+                "alias": null,
+                "args": (v6/*: any*/),
+                "concreteType": "RiskConnection",
+                "kind": "LinkedField",
+                "name": "risks",
+                "plural": false,
+                "selections": [
+                  {
+                    "alias": null,
+                    "args": null,
+                    "concreteType": "RiskEdge",
+                    "kind": "LinkedField",
+                    "name": "edges",
+                    "plural": true,
+                    "selections": [
+                      {
+                        "alias": null,
+                        "args": null,
+                        "concreteType": "Risk",
+                        "kind": "LinkedField",
+                        "name": "node",
+                        "plural": false,
+                        "selections": [
+                          (v8/*: any*/),
+                          {
+                            "alias": null,
+                            "args": null,
+                            "kind": "ScalarField",
+                            "name": "name",
+                            "storageKey": null
+                          },
+                          {
+                            "alias": null,
+                            "args": null,
+                            "kind": "ScalarField",
+                            "name": "description",
+                            "storageKey": null
+                          },
+                          {
+                            "alias": null,
+                            "args": null,
+                            "kind": "ScalarField",
+                            "name": "createdAt",
+                            "storageKey": null
+                          },
+                          {
+                            "alias": null,
+                            "args": null,
+                            "kind": "ScalarField",
+                            "name": "updatedAt",
+                            "storageKey": null
+                          },
+                          (v7/*: any*/)
+                        ],
+                        "storageKey": null
+                      },
+                      {
+                        "alias": null,
+                        "args": null,
+                        "kind": "ScalarField",
+                        "name": "cursor",
+                        "storageKey": null
+                      }
+                    ],
+                    "storageKey": null
+                  },
+                  {
+                    "alias": null,
+                    "args": null,
+                    "concreteType": "PageInfo",
+                    "kind": "LinkedField",
+                    "name": "pageInfo",
+                    "plural": false,
+                    "selections": [
+                      {
+                        "alias": null,
+                        "args": null,
+                        "kind": "ScalarField",
+                        "name": "hasNextPage",
+                        "storageKey": null
+                      },
+                      {
+                        "alias": null,
+                        "args": null,
+                        "kind": "ScalarField",
+                        "name": "hasPreviousPage",
+                        "storageKey": null
+                      },
+                      {
+                        "alias": null,
+                        "args": null,
+                        "kind": "ScalarField",
+                        "name": "startCursor",
+                        "storageKey": null
+                      },
+                      {
+                        "alias": null,
+                        "args": null,
+                        "kind": "ScalarField",
+                        "name": "endCursor",
+                        "storageKey": null
+                      }
+                    ],
+                    "storageKey": null
+                  },
+                  {
+                    "kind": "ClientExtension",
+                    "selections": [
+                      {
+                        "alias": null,
+                        "args": null,
+                        "kind": "ScalarField",
+                        "name": "__id",
+                        "storageKey": null
+                      }
+                    ]
+                  }
+                ],
+                "storageKey": null
+              },
+              {
+                "alias": null,
+                "args": (v6/*: any*/),
+                "filters": null,
+                "handle": "connection",
+                "key": "RiskListView_risks",
+                "kind": "LinkedHandle",
+                "name": "risks"
+              }
+            ],
+            "type": "Organization",
+            "abstractKey": null
+          }
+        ],
+        "storageKey": null
+      }
+    ]
+  },
+  "params": {
+    "cacheID": "ea3c50c98dea1cce588bbb0e8705cbc4",
+    "id": null,
+    "metadata": {},
+    "name": "RiskListViewPaginationQuery",
+    "operationKind": "query",
+    "text": "query RiskListViewPaginationQuery(\n  $after: CursorKey\n  $before: CursorKey\n  $first: Int\n  $last: Int\n  $id: ID!\n) {\n  node(id: $id) {\n    __typename\n    ...RiskListView_risks_pbnwq\n    id\n  }\n}\n\nfragment RiskListView_risks_pbnwq on Organization {\n  risks(first: $first, after: $after, last: $last, before: $before) {\n    edges {\n      node {\n        id\n        name\n        description\n        createdAt\n        updatedAt\n        __typename\n      }\n      cursor\n    }\n    pageInfo {\n      hasNextPage\n      hasPreviousPage\n      startCursor\n      endCursor\n    }\n  }\n  id\n}\n"
+  }
+};
+})();
+
+(node as any).hash = "4a665835c97d7b93725e8bbe708d7cfb";
+
+export default node;
diff --git a/apps/console/src/pages/organizations/risks/__generated__/RiskListViewQuery.graphql.ts b/apps/console/src/pages/organizations/risks/__generated__/RiskListViewQuery.graphql.ts
new file mode 100644
index 000000000..71c2230ad
--- /dev/null
+++ b/apps/console/src/pages/organizations/risks/__generated__/RiskListViewQuery.graphql.ts
@@ -0,0 +1,311 @@
+/**
+ * @generated SignedSource<<2812fb6e9c5db33d4c616daf9a11b012>>
+ * @lightSyntaxTransform
+ * @nogrep
+ */
+
+/* tslint:disable */
+/* eslint-disable */
+// @ts-nocheck
+
+import { ConcreteRequest } from 'relay-runtime';
+import { FragmentRefs } from "relay-runtime";
+export type RiskListViewQuery$variables = {
+  after?: string | null | undefined;
+  before?: string | null | undefined;
+  first?: number | null | undefined;
+  last?: number | null | undefined;
+  organizationId: string;
+};
+export type RiskListViewQuery$data = {
+  readonly organization: {
+    readonly id: string;
+    readonly " $fragmentSpreads": FragmentRefs<"RiskListView_risks">;
+  };
+};
+export type RiskListViewQuery = {
+  response: RiskListViewQuery$data;
+  variables: RiskListViewQuery$variables;
+};
+
+const node: ConcreteRequest = (function(){
+var v0 = {
+  "defaultValue": null,
+  "kind": "LocalArgument",
+  "name": "after"
+},
+v1 = {
+  "defaultValue": null,
+  "kind": "LocalArgument",
+  "name": "before"
+},
+v2 = {
+  "defaultValue": null,
+  "kind": "LocalArgument",
+  "name": "first"
+},
+v3 = {
+  "defaultValue": null,
+  "kind": "LocalArgument",
+  "name": "last"
+},
+v4 = {
+  "defaultValue": null,
+  "kind": "LocalArgument",
+  "name": "organizationId"
+},
+v5 = [
+  {
+    "kind": "Variable",
+    "name": "id",
+    "variableName": "organizationId"
+  }
+],
+v6 = {
+  "alias": null,
+  "args": null,
+  "kind": "ScalarField",
+  "name": "id",
+  "storageKey": null
+},
+v7 = [
+  {
+    "kind": "Variable",
+    "name": "after",
+    "variableName": "after"
+  },
+  {
+    "kind": "Variable",
+    "name": "before",
+    "variableName": "before"
+  },
+  {
+    "kind": "Variable",
+    "name": "first",
+    "variableName": "first"
+  },
+  {
+    "kind": "Variable",
+    "name": "last",
+    "variableName": "last"
+  }
+],
+v8 = {
+  "alias": null,
+  "args": null,
+  "kind": "ScalarField",
+  "name": "__typename",
+  "storageKey": null
+};
+return {
+  "fragment": {
+    "argumentDefinitions": [
+      (v0/*: any*/),
+      (v1/*: any*/),
+      (v2/*: any*/),
+      (v3/*: any*/),
+      (v4/*: any*/)
+    ],
+    "kind": "Fragment",
+    "metadata": null,
+    "name": "RiskListViewQuery",
+    "selections": [
+      {
+        "alias": "organization",
+        "args": (v5/*: any*/),
+        "concreteType": null,
+        "kind": "LinkedField",
+        "name": "node",
+        "plural": false,
+        "selections": [
+          (v6/*: any*/),
+          {
+            "args": (v7/*: any*/),
+            "kind": "FragmentSpread",
+            "name": "RiskListView_risks"
+          }
+        ],
+        "storageKey": null
+      }
+    ],
+    "type": "Query",
+    "abstractKey": null
+  },
+  "kind": "Request",
+  "operation": {
+    "argumentDefinitions": [
+      (v4/*: any*/),
+      (v2/*: any*/),
+      (v0/*: any*/),
+      (v3/*: any*/),
+      (v1/*: any*/)
+    ],
+    "kind": "Operation",
+    "name": "RiskListViewQuery",
+    "selections": [
+      {
+        "alias": "organization",
+        "args": (v5/*: any*/),
+        "concreteType": null,
+        "kind": "LinkedField",
+        "name": "node",
+        "plural": false,
+        "selections": [
+          (v8/*: any*/),
+          (v6/*: any*/),
+          {
+            "kind": "InlineFragment",
+            "selections": [
+              {
+                "alias": null,
+                "args": (v7/*: any*/),
+                "concreteType": "RiskConnection",
+                "kind": "LinkedField",
+                "name": "risks",
+                "plural": false,
+                "selections": [
+                  {
+                    "alias": null,
+                    "args": null,
+                    "concreteType": "RiskEdge",
+                    "kind": "LinkedField",
+                    "name": "edges",
+                    "plural": true,
+                    "selections": [
+                      {
+                        "alias": null,
+                        "args": null,
+                        "concreteType": "Risk",
+                        "kind": "LinkedField",
+                        "name": "node",
+                        "plural": false,
+                        "selections": [
+                          (v6/*: any*/),
+                          {
+                            "alias": null,
+                            "args": null,
+                            "kind": "ScalarField",
+                            "name": "name",
+                            "storageKey": null
+                          },
+                          {
+                            "alias": null,
+                            "args": null,
+                            "kind": "ScalarField",
+                            "name": "description",
+                            "storageKey": null
+                          },
+                          {
+                            "alias": null,
+                            "args": null,
+                            "kind": "ScalarField",
+                            "name": "createdAt",
+                            "storageKey": null
+                          },
+                          {
+                            "alias": null,
+                            "args": null,
+                            "kind": "ScalarField",
+                            "name": "updatedAt",
+                            "storageKey": null
+                          },
+                          (v8/*: any*/)
+                        ],
+                        "storageKey": null
+                      },
+                      {
+                        "alias": null,
+                        "args": null,
+                        "kind": "ScalarField",
+                        "name": "cursor",
+                        "storageKey": null
+                      }
+                    ],
+                    "storageKey": null
+                  },
+                  {
+                    "alias": null,
+                    "args": null,
+                    "concreteType": "PageInfo",
+                    "kind": "LinkedField",
+                    "name": "pageInfo",
+                    "plural": false,
+                    "selections": [
+                      {
+                        "alias": null,
+                        "args": null,
+                        "kind": "ScalarField",
+                        "name": "hasNextPage",
+                        "storageKey": null
+                      },
+                      {
+                        "alias": null,
+                        "args": null,
+                        "kind": "ScalarField",
+                        "name": "hasPreviousPage",
+                        "storageKey": null
+                      },
+                      {
+                        "alias": null,
+                        "args": null,
+                        "kind": "ScalarField",
+                        "name": "startCursor",
+                        "storageKey": null
+                      },
+                      {
+                        "alias": null,
+                        "args": null,
+                        "kind": "ScalarField",
+                        "name": "endCursor",
+                        "storageKey": null
+                      }
+                    ],
+                    "storageKey": null
+                  },
+                  {
+                    "kind": "ClientExtension",
+                    "selections": [
+                      {
+                        "alias": null,
+                        "args": null,
+                        "kind": "ScalarField",
+                        "name": "__id",
+                        "storageKey": null
+                      }
+                    ]
+                  }
+                ],
+                "storageKey": null
+              },
+              {
+                "alias": null,
+                "args": (v7/*: any*/),
+                "filters": null,
+                "handle": "connection",
+                "key": "RiskListView_risks",
+                "kind": "LinkedHandle",
+                "name": "risks"
+              }
+            ],
+            "type": "Organization",
+            "abstractKey": null
+          }
+        ],
+        "storageKey": null
+      }
+    ]
+  },
+  "params": {
+    "cacheID": "7b0cab0d71217df4a49ea2245b2705a8",
+    "id": null,
+    "metadata": {},
+    "name": "RiskListViewQuery",
+    "operationKind": "query",
+    "text": "query RiskListViewQuery(\n  $organizationId: ID!\n  $first: Int\n  $after: CursorKey\n  $last: Int\n  $before: CursorKey\n) {\n  organization: node(id: $organizationId) {\n    __typename\n    id\n    ...RiskListView_risks_pbnwq\n  }\n}\n\nfragment RiskListView_risks_pbnwq on Organization {\n  risks(first: $first, after: $after, last: $last, before: $before) {\n    edges {\n      node {\n        id\n        name\n        description\n        createdAt\n        updatedAt\n        __typename\n      }\n      cursor\n    }\n    pageInfo {\n      hasNextPage\n      hasPreviousPage\n      startCursor\n      endCursor\n    }\n  }\n  id\n}\n"
+  }
+};
+})();
+
+(node as any).hash = "0fff20fd656047e6df52818ccf0a0f3b";
+
+export default node;
diff --git a/apps/console/src/pages/organizations/risks/__generated__/RiskListView_risks.graphql.ts b/apps/console/src/pages/organizations/risks/__generated__/RiskListView_risks.graphql.ts
new file mode 100644
index 000000000..315d622ec
--- /dev/null
+++ b/apps/console/src/pages/organizations/risks/__generated__/RiskListView_risks.graphql.ts
@@ -0,0 +1,244 @@
+/**
+ * @generated SignedSource<<5cb8bd63e484e9c8d842ddf05618d475>>
+ * @lightSyntaxTransform
+ * @nogrep
+ */
+
+/* tslint:disable */
+/* eslint-disable */
+// @ts-nocheck
+
+import { ReaderFragment } from 'relay-runtime';
+import { FragmentRefs } from "relay-runtime";
+export type RiskListView_risks$data = {
+  readonly id: string;
+  readonly risks: {
+    readonly __id: string;
+    readonly edges: ReadonlyArray<{
+      readonly node: {
+        readonly createdAt: string;
+        readonly description: string;
+        readonly id: string;
+        readonly name: string;
+        readonly updatedAt: string;
+      };
+    }>;
+    readonly pageInfo: {
+      readonly endCursor: string | null | undefined;
+      readonly hasNextPage: boolean;
+      readonly hasPreviousPage: boolean;
+      readonly startCursor: string | null | undefined;
+    };
+  };
+  readonly " $fragmentType": "RiskListView_risks";
+};
+export type RiskListView_risks$key = {
+  readonly " $data"?: RiskListView_risks$data;
+  readonly " $fragmentSpreads": FragmentRefs<"RiskListView_risks">;
+};
+
+const node: ReaderFragment = (function(){
+var v0 = [
+  "risks"
+],
+v1 = {
+  "alias": null,
+  "args": null,
+  "kind": "ScalarField",
+  "name": "id",
+  "storageKey": null
+};
+return {
+  "argumentDefinitions": [
+    {
+      "defaultValue": null,
+      "kind": "LocalArgument",
+      "name": "after"
+    },
+    {
+      "defaultValue": null,
+      "kind": "LocalArgument",
+      "name": "before"
+    },
+    {
+      "defaultValue": null,
+      "kind": "LocalArgument",
+      "name": "first"
+    },
+    {
+      "defaultValue": null,
+      "kind": "LocalArgument",
+      "name": "last"
+    }
+  ],
+  "kind": "Fragment",
+  "metadata": {
+    "connection": [
+      {
+        "count": null,
+        "cursor": null,
+        "direction": "bidirectional",
+        "path": (v0/*: any*/)
+      }
+    ],
+    "refetch": {
+      "connection": {
+        "forward": {
+          "count": "first",
+          "cursor": "after"
+        },
+        "backward": {
+          "count": "last",
+          "cursor": "before"
+        },
+        "path": (v0/*: any*/)
+      },
+      "fragmentPathInResult": [
+        "node"
+      ],
+      "operation": require('./RiskListViewPaginationQuery.graphql'),
+      "identifierInfo": {
+        "identifierField": "id",
+        "identifierQueryVariableName": "id"
+      }
+    }
+  },
+  "name": "RiskListView_risks",
+  "selections": [
+    {
+      "alias": "risks",
+      "args": null,
+      "concreteType": "RiskConnection",
+      "kind": "LinkedField",
+      "name": "__RiskListView_risks_connection",
+      "plural": false,
+      "selections": [
+        {
+          "alias": null,
+          "args": null,
+          "concreteType": "RiskEdge",
+          "kind": "LinkedField",
+          "name": "edges",
+          "plural": true,
+          "selections": [
+            {
+              "alias": null,
+              "args": null,
+              "concreteType": "Risk",
+              "kind": "LinkedField",
+              "name": "node",
+              "plural": false,
+              "selections": [
+                (v1/*: any*/),
+                {
+                  "alias": null,
+                  "args": null,
+                  "kind": "ScalarField",
+                  "name": "name",
+                  "storageKey": null
+                },
+                {
+                  "alias": null,
+                  "args": null,
+                  "kind": "ScalarField",
+                  "name": "description",
+                  "storageKey": null
+                },
+                {
+                  "alias": null,
+                  "args": null,
+                  "kind": "ScalarField",
+                  "name": "createdAt",
+                  "storageKey": null
+                },
+                {
+                  "alias": null,
+                  "args": null,
+                  "kind": "ScalarField",
+                  "name": "updatedAt",
+                  "storageKey": null
+                },
+                {
+                  "alias": null,
+                  "args": null,
+                  "kind": "ScalarField",
+                  "name": "__typename",
+                  "storageKey": null
+                }
+              ],
+              "storageKey": null
+            },
+            {
+              "alias": null,
+              "args": null,
+              "kind": "ScalarField",
+              "name": "cursor",
+              "storageKey": null
+            }
+          ],
+          "storageKey": null
+        },
+        {
+          "alias": null,
+          "args": null,
+          "concreteType": "PageInfo",
+          "kind": "LinkedField",
+          "name": "pageInfo",
+          "plural": false,
+          "selections": [
+            {
+              "alias": null,
+              "args": null,
+              "kind": "ScalarField",
+              "name": "hasNextPage",
+              "storageKey": null
+            },
+            {
+              "alias": null,
+              "args": null,
+              "kind": "ScalarField",
+              "name": "hasPreviousPage",
+              "storageKey": null
+            },
+            {
+              "alias": null,
+              "args": null,
+              "kind": "ScalarField",
+              "name": "startCursor",
+              "storageKey": null
+            },
+            {
+              "alias": null,
+              "args": null,
+              "kind": "ScalarField",
+              "name": "endCursor",
+              "storageKey": null
+            }
+          ],
+          "storageKey": null
+        },
+        {
+          "kind": "ClientExtension",
+          "selections": [
+            {
+              "alias": null,
+              "args": null,
+              "kind": "ScalarField",
+              "name": "__id",
+              "storageKey": null
+            }
+          ]
+        }
+      ],
+      "storageKey": null
+    },
+    (v1/*: any*/)
+  ],
+  "type": "Organization",
+  "abstractKey": null
+};
+})();
+
+(node as any).hash = "4a665835c97d7b93725e8bbe708d7cfb";
+
+export default node;
diff --git a/pkg/coredata/entity_type_reg.go b/pkg/coredata/entity_type_reg.go
index 225814468..12c01c134 100644
--- a/pkg/coredata/entity_type_reg.go
+++ b/pkg/coredata/entity_type_reg.go
@@ -20,14 +20,15 @@ const (
 	MitigationEntityType
 	TaskEntityType
 	EvidenceEntityType
-	ControlStateTransitionEntityType
-	TaskStateTransitionEntityType
+	_ControlStateTransitionEntityType
+	_TaskStateTransitionEntityType
 	VendorEntityType
 	PeopleEntityType
-	EvidenceStateTransitionEntityType
+	_EvidenceStateTransitionEntityType
 	PolicyEntityType
 	UserEntityType
 	SessionEntityType
 	EmailEntityType
 	ControlEntityType
+	RiskEntityType
 )
diff --git a/pkg/coredata/migrations/20250330T163200Z.sql b/pkg/coredata/migrations/20250330T163200Z.sql
new file mode 100644
index 000000000..1079581e1
--- /dev/null
+++ b/pkg/coredata/migrations/20250330T163200Z.sql
@@ -0,0 +1,9 @@
+CREATE TABLE risks (
+    id TEXT PRIMARY KEY, 
+    tenant_id TEXT NOT NULL,
+    organization_id TEXT NOT NULL REFERENCES organizations(id),
+    name TEXT NOT NULL,
+    description TEXT,
+    created_at TIMESTAMP NOT NULL,
+    updated_at TIMESTAMP NOT NULL
+);
diff --git a/pkg/coredata/risk.go b/pkg/coredata/risk.go
new file mode 100644
index 000000000..c646c4899
--- /dev/null
+++ b/pkg/coredata/risk.go
@@ -0,0 +1,198 @@
+// Copyright (c) 2025 Probo Inc <hello@getprobo.com>.
+//
+// Permission to use, copy, modify, and/or distribute this software for any
+// purpose with or without fee is hereby granted, provided that the above
+// copyright notice and this permission notice appear in all copies.
+//
+// THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH
+// REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+// AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT,
+// INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+// LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR
+// OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+// PERFORMANCE OF THIS SOFTWARE.
+
+package coredata
+
+import (
+	"context"
+	"fmt"
+	"maps"
+	"time"
+
+	"github.com/getprobo/probo/pkg/gid"
+	"github.com/getprobo/probo/pkg/page"
+	"github.com/jackc/pgx/v5"
+	"go.gearno.de/kit/pg"
+)
+
+type (
+	Risk struct {
+		ID             gid.GID
+		OrganizationID gid.GID
+		Name           string
+		Description    string
+		CreatedAt      time.Time
+		UpdatedAt      time.Time
+	}
+
+	Risks []*Risk
+)
+
+func (r *Risk) CursorKey(orderBy RiskOrderField) page.CursorKey {
+	switch orderBy {
+	case RiskOrderFieldCreatedAt:
+		return page.CursorKey{ID: r.ID, Value: r.CreatedAt}
+	}
+
+	panic(fmt.Sprintf("unsupported order by: %s", orderBy))
+}
+
+func (r *Risks) LoadByOrganizationID(
+	ctx context.Context,
+	conn pg.Conn,
+	scope Scoper,
+	organizationID gid.GID,
+	cursor *page.Cursor[RiskOrderField],
+) error {
+	q := `
+SELECT
+	id,
+	organization_id,
+	name,
+	description,
+	created_at,
+	updated_at
+FROM risks
+WHERE %s
+	AND organization_id = @organization_id
+	AND %s
+`
+	q = fmt.Sprintf(q, scope.SQLFragment(), cursor.SQLFragment())
+
+	args := pgx.NamedArgs{"organization_id": organizationID}
+	maps.Copy(args, scope.SQLArguments())
+
+	rows, err := conn.Query(ctx, q, args)
+	if err != nil {
+		return fmt.Errorf("cannot query risks: %w", err)
+	}
+
+	risks, err := pgx.CollectRows(rows, pgx.RowToAddrOfStructByName[Risk])
+	if err != nil {
+		return fmt.Errorf("cannot collect risks: %w", err)
+	}
+
+	*r = risks
+
+	return nil
+}
+
+func (r *Risk) LoadByID(
+	ctx context.Context,
+	conn pg.Conn,
+	scope Scoper,
+	riskID gid.GID,
+) error {
+	q := `
+SELECT
+	id,
+	organization_id,
+	name,
+	description,
+	created_at,
+	updated_at
+FROM risks
+WHERE %s
+	AND id = @id
+LIMIT 1;
+`
+	q = fmt.Sprintf(q, scope.SQLFragment())
+
+	args := pgx.StrictNamedArgs{"id": r.ID}
+	maps.Copy(args, scope.SQLArguments())
+
+	rows, err := conn.Query(ctx, q, args)
+	if err != nil {
+		return fmt.Errorf("cannot query risk: %w", err)
+	}
+
+	risk, err := pgx.CollectExactlyOneRow(rows, pgx.RowToStructByName[Risk])
+	if err != nil {
+		return fmt.Errorf("cannot collect risk: %w", err)
+	}
+
+	*r = risk
+
+	return nil
+}
+
+func (r *Risk) Insert(
+	ctx context.Context,
+	conn pg.Conn,
+	scope Scoper,
+) error {
+	q := `
+INSERT INTO risks (id, tenant_id, organization_id, name, description, created_at, updated_at)
+VALUES (@id, @tenant_id, @organization_id, @name, @description, @created_at, @updated_at)
+`
+
+	args := pgx.StrictNamedArgs{
+		"id":              r.ID,
+		"tenant_id":       scope.GetTenantID(),
+		"organization_id": r.OrganizationID,
+		"name":            r.Name,
+		"description":     r.Description,
+		"created_at":      r.CreatedAt,
+		"updated_at":      r.UpdatedAt,
+	}
+
+	_, err := conn.Exec(ctx, q, args)
+	return err
+}
+
+func (r *Risk) Update(
+	ctx context.Context,
+	conn pg.Conn,
+	scope Scoper,
+) error {
+	q := `
+UPDATE risks
+SET
+	name = @name,
+	description = @description,
+	updated_at = @updated_at
+WHERE %s
+	AND tenant_id = @tenant_id
+`
+	q = fmt.Sprintf(q, scope.SQLFragment())
+
+	args := pgx.StrictNamedArgs{
+		"name":        r.Name,
+		"description": r.Description,
+		"updated_at":  r.UpdatedAt,
+	}
+	maps.Copy(args, scope.SQLArguments())
+
+	_, err := conn.Exec(ctx, q, args)
+	return err
+}
+
+func (r *Risk) Delete(
+	ctx context.Context,
+	conn pg.Conn,
+	scope Scoper,
+) error {
+	q := `
+DELETE FROM risks WHERE %s AND id = @id
+`
+	q = fmt.Sprintf(q, scope.SQLFragment())
+
+	args := pgx.StrictNamedArgs{
+		"id": r.ID,
+	}
+	maps.Copy(args, scope.SQLArguments())
+
+	_, err := conn.Exec(ctx, q, args)
+	return err
+}
diff --git a/pkg/coredata/risk_order_field.go b/pkg/coredata/risk_order_field.go
new file mode 100644
index 000000000..6da4ce1eb
--- /dev/null
+++ b/pkg/coredata/risk_order_field.go
@@ -0,0 +1,40 @@
+// Copyright (c) 2025 Probo Inc <hello@getprobo.com>.
+//
+// Permission to use, copy, modify, and/or distribute this software for any
+// purpose with or without fee is hereby granted, provided that the above
+// copyright notice and this permission notice appear in all copies.
+//
+// THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH
+// REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+// AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT,
+// INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+// LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR
+// OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+// PERFORMANCE OF THIS SOFTWARE.
+
+package coredata
+
+type (
+	RiskOrderField string
+)
+
+const (
+	RiskOrderFieldCreatedAt RiskOrderField = "CREATED_AT"
+)
+
+func (p RiskOrderField) Column() string {
+	return string(p)
+}
+
+func (p RiskOrderField) String() string {
+	return string(p)
+}
+
+func (p RiskOrderField) MarshalText() ([]byte, error) {
+	return []byte(p.String()), nil
+}
+
+func (p *RiskOrderField) UnmarshalText(text []byte) error {
+	*p = RiskOrderField(text)
+	return nil
+}
diff --git a/pkg/probo/risk_service.go b/pkg/probo/risk_service.go
new file mode 100644
index 000000000..ceab69a9c
--- /dev/null
+++ b/pkg/probo/risk_service.go
@@ -0,0 +1,173 @@
+// Copyright (c) 2025 Probo Inc <hello@getprobo.com>.
+//
+// Permission to use, copy, modify, and/or distribute this software for any
+// purpose with or without fee is hereby granted, provided that the above
+// copyright notice and this permission notice appear in all copies.
+//
+// THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH
+// REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+// AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT,
+// INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+// LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR
+// OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+// PERFORMANCE OF THIS SOFTWARE.
+
+package probo
+
+import (
+	"context"
+	"fmt"
+	"time"
+
+	"github.com/getprobo/probo/pkg/coredata"
+	"github.com/getprobo/probo/pkg/gid"
+	"github.com/getprobo/probo/pkg/page"
+	"go.gearno.de/kit/pg"
+)
+
+type (
+	RiskService struct {
+		svc *TenantService
+	}
+
+	CreateRiskRequest struct {
+		OrganizationID gid.GID
+		Name           string
+		Description    string
+	}
+
+	UpdateRiskRequest struct {
+		ID          gid.GID
+		Name        *string
+		Description *string
+	}
+)
+
+func (s RiskService) Create(
+	ctx context.Context,
+	req CreateRiskRequest,
+) (*coredata.Risk, error) {
+	now := time.Now()
+	riskID, err := gid.NewGID(s.svc.scope.GetTenantID(), coredata.RiskEntityType)
+	if err != nil {
+		return nil, fmt.Errorf("cannot create global id: %w", err)
+	}
+
+	risk := &coredata.Risk{
+		ID:             riskID,
+		OrganizationID: req.OrganizationID,
+		Name:           req.Name,
+		Description:    req.Description,
+		CreatedAt:      now,
+		UpdatedAt:      now,
+	}
+
+	err = s.svc.pg.WithConn(
+		ctx,
+		func(conn pg.Conn) error {
+			return risk.Insert(ctx, conn, s.svc.scope)
+		},
+	)
+
+	if err != nil {
+		return nil, fmt.Errorf("cannot create risk: %w", err)
+	}
+
+	return risk, nil
+}
+
+func (s RiskService) Get(
+	ctx context.Context,
+	riskID gid.GID,
+) (*coredata.Risk, error) {
+	risk := &coredata.Risk{}
+
+	err := s.svc.pg.WithConn(
+		ctx,
+		func(conn pg.Conn) error {
+			return risk.LoadByID(ctx, conn, s.svc.scope, riskID)
+		},
+	)
+
+	if err != nil {
+		return nil, fmt.Errorf("cannot get risk: %w", err)
+	}
+
+	return risk, nil
+}
+
+func (s RiskService) Update(
+	ctx context.Context,
+	req UpdateRiskRequest,
+) (*coredata.Risk, error) {
+	risk := &coredata.Risk{ID: req.ID}
+
+	err := s.svc.pg.WithTx(
+		ctx,
+		func(conn pg.Conn) error {
+			if err := risk.LoadByID(ctx, conn, s.svc.scope, req.ID); err != nil {
+				return fmt.Errorf("cannot load risk: %w", err)
+			}
+
+			if req.Name != nil {
+				risk.Name = *req.Name
+			}
+
+			if req.Description != nil {
+				risk.Description = *req.Description
+			}
+
+			if err := risk.Update(ctx, conn, s.svc.scope); err != nil {
+				return fmt.Errorf("cannot update risk: %w", err)
+			}
+
+			return nil
+		},
+	)
+	if err != nil {
+		return nil, fmt.Errorf("cannot update risk: %w", err)
+	}
+
+	return risk, nil
+}
+
+func (s RiskService) Delete(
+	ctx context.Context,
+	riskID gid.GID,
+) error {
+	risk := &coredata.Risk{ID: riskID}
+
+	return s.svc.pg.WithConn(
+		ctx,
+		func(conn pg.Conn) error {
+			return risk.Delete(ctx, conn, s.svc.scope)
+		},
+	)
+}
+
+func (s RiskService) ListForOrganizationID(
+	ctx context.Context,
+	organizationID gid.GID,
+	cursor *page.Cursor[coredata.RiskOrderField],
+) (*page.Page[*coredata.Risk, coredata.RiskOrderField], error) {
+	var risks coredata.Risks
+
+	err := s.svc.pg.WithConn(
+		ctx,
+		func(conn pg.Conn) error {
+			return risks.LoadByOrganizationID(
+				ctx,
+				conn,
+				s.svc.scope,
+				organizationID,
+				cursor,
+			)
+		},
+	)
+
+	if err != nil {
+		return nil, fmt.Errorf("cannot list risks: %w", err)
+	}
+
+	return page.NewPage(risks, cursor), nil
+}
diff --git a/pkg/probo/service.go b/pkg/probo/service.go
index 8e5491fa2..9cc16443e 100644
--- a/pkg/probo/service.go
+++ b/pkg/probo/service.go
@@ -47,6 +47,7 @@ type (
 		Peoples       *PeopleService
 		Policies      *PolicyService
 		Controls      *ControlService
+		Risks         *RiskService
 	}
 )
 
@@ -86,6 +87,7 @@ func (s *Service) WithTenant(tenantID gid.TenantID) *TenantService {
 	tenantService.Policies = &PolicyService{svc: tenantService}
 	tenantService.Organizations = &OrganizationService{svc: tenantService}
 	tenantService.Controls = &ControlService{svc: tenantService}
+	tenantService.Risks = &RiskService{svc: tenantService}
 
 	return tenantService
 }
diff --git a/pkg/server/api/console/v1/schema.graphql b/pkg/server/api/console/v1/schema.graphql
index 1331a39f7..0999f7f14 100644
--- a/pkg/server/api/console/v1/schema.graphql
+++ b/pkg/server/api/console/v1/schema.graphql
@@ -215,6 +215,14 @@ enum PolicyOrderField
   NAME
 }
 
+enum RiskOrderField
+  @goModel(model: "github.com/getprobo/probo/pkg/coredata.RiskOrderField") {
+  CREATED_AT
+    @goEnum(
+      value: "github.com/getprobo/probo/pkg/coredata.RiskOrderFieldCreatedAt"
+    )
+}
+
 enum EvidenceOrderField
   @goModel(model: "github.com/getprobo/probo/pkg/coredata.EvidenceOrderField") {
   CREATED_AT
@@ -291,6 +299,14 @@ input PolicyOrder
   field: PolicyOrderField!
 }
 
+input RiskOrder
+  @goModel(
+    model: "github.com/getprobo/probo/pkg/server/api/console/v1/types.RiskOrderBy"
+  ) {
+  direction: OrderDirection!
+  field: RiskOrderField!
+}
+
 input EvidenceOrder
   @goModel(
     model: "github.com/getprobo/probo/pkg/server/api/console/v1/types.EvidenceOrderBy"
@@ -358,6 +374,14 @@ type Organization implements Node {
     orderBy: MitigationOrder
   ): MitigationConnection! @goField(forceResolver: true)
 
+  risks(
+    first: Int
+    after: CursorKey
+    last: Int
+    before: CursorKey
+    orderBy: RiskOrder
+  ): RiskConnection! @goField(forceResolver: true)
+
   createdAt: Datetime!
   updatedAt: Datetime!
 }
@@ -487,6 +511,14 @@ type Policy implements Node {
   updatedAt: Datetime!
 }
 
+type Risk implements Node {
+  id: ID!
+  name: String!
+  description: String!
+  createdAt: Datetime!
+  updatedAt: Datetime!
+}
+
 type Session {
   id: ID!
   expiresAt: Datetime!
@@ -606,6 +638,16 @@ type PolicyEdge {
   node: Policy!
 }
 
+type RiskConnection {
+  edges: [RiskEdge!]!
+  pageInfo: PageInfo!
+}
+
+type RiskEdge {
+  cursor: CursorKey!
+  node: Risk!
+}
+
 # Root Types
 type Query {
   node(id: ID!): Node!
@@ -657,6 +699,11 @@ type Mutation {
   assignTask(input: AssignTaskInput!): AssignTaskPayload!
   unassignTask(input: UnassignTaskInput!): UnassignTaskPayload!
 
+  # Risk mutations
+  createRisk(input: CreateRiskInput!): CreateRiskPayload!
+  updateRisk(input: UpdateRiskInput!): UpdateRiskPayload!
+  deleteRisk(input: DeleteRiskInput!): DeleteRiskPayload!
+
   # Evidence mutations
   uploadEvidence(input: UploadEvidenceInput!): UploadEvidencePayload!
   deleteEvidence(input: DeleteEvidenceInput!): DeleteEvidencePayload!
@@ -804,6 +851,22 @@ input UnassignTaskInput {
   taskId: ID!
 }
 
+input CreateRiskInput {
+  organizationId: ID!
+  name: String!
+  description: String!
+}
+
+input UpdateRiskInput {
+  id: ID!
+  name: String
+  description: String
+}
+
+input DeleteRiskInput {
+  riskId: ID!
+}
+
 input UploadEvidenceInput {
   taskId: ID!
   name: String!
@@ -939,6 +1002,18 @@ type UnassignTaskPayload {
   task: Task!
 }
 
+type CreateRiskPayload {
+  riskEdge: RiskEdge!
+}
+
+type UpdateRiskPayload {
+  risk: Risk!
+}
+
+type DeleteRiskPayload {
+  deletedRiskId: ID!
+}
+
 type UploadEvidencePayload {
   evidenceEdge: EvidenceEdge!
 }
diff --git a/pkg/server/api/console/v1/schema/schema.go b/pkg/server/api/console/v1/schema/schema.go
index 8599bb28e..da6a1d2ee 100644
--- a/pkg/server/api/console/v1/schema/schema.go
+++ b/pkg/server/api/console/v1/schema/schema.go
@@ -104,6 +104,10 @@ type ComplexityRoot struct {
 		PolicyEdge func(childComplexity int) int
 	}
 
+	CreateRiskPayload struct {
+		RiskEdge func(childComplexity int) int
+	}
+
 	CreateTaskPayload struct {
 		TaskEdge func(childComplexity int) int
 	}
@@ -132,6 +136,10 @@ type ComplexityRoot struct {
 		DeletedPolicyID func(childComplexity int) int
 	}
 
+	DeleteRiskPayload struct {
+		DeletedRiskID func(childComplexity int) int
+	}
+
 	DeleteTaskPayload struct {
 		DeletedTaskID func(childComplexity int) int
 	}
@@ -225,6 +233,7 @@ type ComplexityRoot struct {
 		CreateOrganization func(childComplexity int, input types.CreateOrganizationInput) int
 		CreatePeople       func(childComplexity int, input types.CreatePeopleInput) int
 		CreatePolicy       func(childComplexity int, input types.CreatePolicyInput) int
+		CreateRisk         func(childComplexity int, input types.CreateRiskInput) int
 		CreateTask         func(childComplexity int, input types.CreateTaskInput) int
 		CreateVendor       func(childComplexity int, input types.CreateVendorInput) int
 		DeleteEvidence     func(childComplexity int, input types.DeleteEvidenceInput) int
@@ -232,6 +241,7 @@ type ComplexityRoot struct {
 		DeleteOrganization func(childComplexity int, input types.DeleteOrganizationInput) int
 		DeletePeople       func(childComplexity int, input types.DeletePeopleInput) int
 		DeletePolicy       func(childComplexity int, input types.DeletePolicyInput) int
+		DeleteRisk         func(childComplexity int, input types.DeleteRiskInput) int
 		DeleteTask         func(childComplexity int, input types.DeleteTaskInput) int
 		DeleteVendor       func(childComplexity int, input types.DeleteVendorInput) int
 		ImportFramework    func(childComplexity int, input types.ImportFrameworkInput) int
@@ -244,6 +254,7 @@ type ComplexityRoot struct {
 		UpdateOrganization func(childComplexity int, input types.UpdateOrganizationInput) int
 		UpdatePeople       func(childComplexity int, input types.UpdatePeopleInput) int
 		UpdatePolicy       func(childComplexity int, input types.UpdatePolicyInput) int
+		UpdateRisk         func(childComplexity int, input types.UpdateRiskInput) int
 		UpdateTask         func(childComplexity int, input types.UpdateTaskInput) int
 		UpdateVendor       func(childComplexity int, input types.UpdateVendorInput) int
 		UploadEvidence     func(childComplexity int, input types.UploadEvidenceInput) int
@@ -258,6 +269,7 @@ type ComplexityRoot struct {
 		Name        func(childComplexity int) int
 		Peoples     func(childComplexity int, first *int, after *page.CursorKey, last *int, before *page.CursorKey, orderBy *types.PeopleOrderBy) int
 		Policies    func(childComplexity int, first *int, after *page.CursorKey, last *int, before *page.CursorKey, orderBy *types.PolicyOrderBy) int
+		Risks       func(childComplexity int, first *int, after *page.CursorKey, last *int, before *page.CursorKey, orderBy *types.RiskOrderBy) int
 		UpdatedAt   func(childComplexity int) int
 		Users       func(childComplexity int, first *int, after *page.CursorKey, last *int, before *page.CursorKey, orderBy *types.UserOrderBy) int
 		Vendors     func(childComplexity int, first *int, after *page.CursorKey, last *int, before *page.CursorKey, orderBy *types.VendorOrderBy) int
@@ -330,6 +342,24 @@ type ComplexityRoot struct {
 		Success func(childComplexity int) int
 	}
 
+	Risk struct {
+		CreatedAt   func(childComplexity int) int
+		Description func(childComplexity int) int
+		ID          func(childComplexity int) int
+		Name        func(childComplexity int) int
+		UpdatedAt   func(childComplexity int) int
+	}
+
+	RiskConnection struct {
+		Edges    func(childComplexity int) int
+		PageInfo func(childComplexity int) int
+	}
+
+	RiskEdge struct {
+		Cursor func(childComplexity int) int
+		Node   func(childComplexity int) int
+	}
+
 	Session struct {
 		ExpiresAt func(childComplexity int) int
 		ID        func(childComplexity int) int
@@ -381,6 +411,10 @@ type ComplexityRoot struct {
 		Policy func(childComplexity int) int
 	}
 
+	UpdateRiskPayload struct {
+		Risk func(childComplexity int) int
+	}
+
 	UpdateTaskPayload struct {
 		Task func(childComplexity int) int
 	}
@@ -477,6 +511,9 @@ type MutationResolver interface {
 	DeleteTask(ctx context.Context, input types.DeleteTaskInput) (*types.DeleteTaskPayload, error)
 	AssignTask(ctx context.Context, input types.AssignTaskInput) (*types.AssignTaskPayload, error)
 	UnassignTask(ctx context.Context, input types.UnassignTaskInput) (*types.UnassignTaskPayload, error)
+	CreateRisk(ctx context.Context, input types.CreateRiskInput) (*types.CreateRiskPayload, error)
+	UpdateRisk(ctx context.Context, input types.UpdateRiskInput) (*types.UpdateRiskPayload, error)
+	DeleteRisk(ctx context.Context, input types.DeleteRiskInput) (*types.DeleteRiskPayload, error)
 	UploadEvidence(ctx context.Context, input types.UploadEvidenceInput) (*types.UploadEvidencePayload, error)
 	DeleteEvidence(ctx context.Context, input types.DeleteEvidenceInput) (*types.DeleteEvidencePayload, error)
 	CreatePolicy(ctx context.Context, input types.CreatePolicyInput) (*types.CreatePolicyPayload, error)
@@ -491,6 +528,7 @@ type OrganizationResolver interface {
 	Peoples(ctx context.Context, obj *types.Organization, first *int, after *page.CursorKey, last *int, before *page.CursorKey, orderBy *types.PeopleOrderBy) (*types.PeopleConnection, error)
 	Policies(ctx context.Context, obj *types.Organization, first *int, after *page.CursorKey, last *int, before *page.CursorKey, orderBy *types.PolicyOrderBy) (*types.PolicyConnection, error)
 	Mitigations(ctx context.Context, obj *types.Organization, first *int, after *page.CursorKey, last *int, before *page.CursorKey, orderBy *types.MitigationOrderBy) (*types.MitigationConnection, error)
+	Risks(ctx context.Context, obj *types.Organization, first *int, after *page.CursorKey, last *int, before *page.CursorKey, orderBy *types.RiskOrderBy) (*types.RiskConnection, error)
 }
 type PolicyResolver interface {
 	Owner(ctx context.Context, obj *types.Policy) (*types.People, error)
@@ -645,6 +683,13 @@ func (e *executableSchema) Complexity(typeName, field string, childComplexity in
 
 		return e.complexity.CreatePolicyPayload.PolicyEdge(childComplexity), true
 
+	case "CreateRiskPayload.riskEdge":
+		if e.complexity.CreateRiskPayload.RiskEdge == nil {
+			break
+		}
+
+		return e.complexity.CreateRiskPayload.RiskEdge(childComplexity), true
+
 	case "CreateTaskPayload.taskEdge":
 		if e.complexity.CreateTaskPayload.TaskEdge == nil {
 			break
@@ -694,6 +739,13 @@ func (e *executableSchema) Complexity(typeName, field string, childComplexity in
 
 		return e.complexity.DeletePolicyPayload.DeletedPolicyID(childComplexity), true
 
+	case "DeleteRiskPayload.deletedRiskId":
+		if e.complexity.DeleteRiskPayload.DeletedRiskID == nil {
+			break
+		}
+
+		return e.complexity.DeleteRiskPayload.DeletedRiskID(childComplexity), true
+
 	case "DeleteTaskPayload.deletedTaskId":
 		if e.complexity.DeleteTaskPayload.DeletedTaskID == nil {
 			break
@@ -1089,6 +1141,18 @@ func (e *executableSchema) Complexity(typeName, field string, childComplexity in
 
 		return e.complexity.Mutation.CreatePolicy(childComplexity, args["input"].(types.CreatePolicyInput)), true
 
+	case "Mutation.createRisk":
+		if e.complexity.Mutation.CreateRisk == nil {
+			break
+		}
+
+		args, err := ec.field_Mutation_createRisk_args(context.TODO(), rawArgs)
+		if err != nil {
+			return 0, false
+		}
+
+		return e.complexity.Mutation.CreateRisk(childComplexity, args["input"].(types.CreateRiskInput)), true
+
 	case "Mutation.createTask":
 		if e.complexity.Mutation.CreateTask == nil {
 			break
@@ -1173,6 +1237,18 @@ func (e *executableSchema) Complexity(typeName, field string, childComplexity in
 
 		return e.complexity.Mutation.DeletePolicy(childComplexity, args["input"].(types.DeletePolicyInput)), true
 
+	case "Mutation.deleteRisk":
+		if e.complexity.Mutation.DeleteRisk == nil {
+			break
+		}
+
+		args, err := ec.field_Mutation_deleteRisk_args(context.TODO(), rawArgs)
+		if err != nil {
+			return 0, false
+		}
+
+		return e.complexity.Mutation.DeleteRisk(childComplexity, args["input"].(types.DeleteRiskInput)), true
+
 	case "Mutation.deleteTask":
 		if e.complexity.Mutation.DeleteTask == nil {
 			break
@@ -1317,6 +1393,18 @@ func (e *executableSchema) Complexity(typeName, field string, childComplexity in
 
 		return e.complexity.Mutation.UpdatePolicy(childComplexity, args["input"].(types.UpdatePolicyInput)), true
 
+	case "Mutation.updateRisk":
+		if e.complexity.Mutation.UpdateRisk == nil {
+			break
+		}
+
+		args, err := ec.field_Mutation_updateRisk_args(context.TODO(), rawArgs)
+		if err != nil {
+			return 0, false
+		}
+
+		return e.complexity.Mutation.UpdateRisk(childComplexity, args["input"].(types.UpdateRiskInput)), true
+
 	case "Mutation.updateTask":
 		if e.complexity.Mutation.UpdateTask == nil {
 			break
@@ -1429,6 +1517,18 @@ func (e *executableSchema) Complexity(typeName, field string, childComplexity in
 
 		return e.complexity.Organization.Policies(childComplexity, args["first"].(*int), args["after"].(*page.CursorKey), args["last"].(*int), args["before"].(*page.CursorKey), args["orderBy"].(*types.PolicyOrderBy)), true
 
+	case "Organization.risks":
+		if e.complexity.Organization.Risks == nil {
+			break
+		}
+
+		args, err := ec.field_Organization_risks_args(context.TODO(), rawArgs)
+		if err != nil {
+			return 0, false
+		}
+
+		return e.complexity.Organization.Risks(childComplexity, args["first"].(*int), args["after"].(*page.CursorKey), args["last"].(*int), args["before"].(*page.CursorKey), args["orderBy"].(*types.RiskOrderBy)), true
+
 	case "Organization.updatedAt":
 		if e.complexity.Organization.UpdatedAt == nil {
 			break
@@ -1703,6 +1803,69 @@ func (e *executableSchema) Complexity(typeName, field string, childComplexity in
 
 		return e.complexity.RemoveUserPayload.Success(childComplexity), true
 
+	case "Risk.createdAt":
+		if e.complexity.Risk.CreatedAt == nil {
+			break
+		}
+
+		return e.complexity.Risk.CreatedAt(childComplexity), true
+
+	case "Risk.description":
+		if e.complexity.Risk.Description == nil {
+			break
+		}
+
+		return e.complexity.Risk.Description(childComplexity), true
+
+	case "Risk.id":
+		if e.complexity.Risk.ID == nil {
+			break
+		}
+
+		return e.complexity.Risk.ID(childComplexity), true
+
+	case "Risk.name":
+		if e.complexity.Risk.Name == nil {
+			break
+		}
+
+		return e.complexity.Risk.Name(childComplexity), true
+
+	case "Risk.updatedAt":
+		if e.complexity.Risk.UpdatedAt == nil {
+			break
+		}
+
+		return e.complexity.Risk.UpdatedAt(childComplexity), true
+
+	case "RiskConnection.edges":
+		if e.complexity.RiskConnection.Edges == nil {
+			break
+		}
+
+		return e.complexity.RiskConnection.Edges(childComplexity), true
+
+	case "RiskConnection.pageInfo":
+		if e.complexity.RiskConnection.PageInfo == nil {
+			break
+		}
+
+		return e.complexity.RiskConnection.PageInfo(childComplexity), true
+
+	case "RiskEdge.cursor":
+		if e.complexity.RiskEdge.Cursor == nil {
+			break
+		}
+
+		return e.complexity.RiskEdge.Cursor(childComplexity), true
+
+	case "RiskEdge.node":
+		if e.complexity.RiskEdge.Node == nil {
+			break
+		}
+
+		return e.complexity.RiskEdge.Node(childComplexity), true
+
 	case "Session.expiresAt":
 		if e.complexity.Session.ExpiresAt == nil {
 			break
@@ -1855,6 +2018,13 @@ func (e *executableSchema) Complexity(typeName, field string, childComplexity in
 
 		return e.complexity.UpdatePolicyPayload.Policy(childComplexity), true
 
+	case "UpdateRiskPayload.risk":
+		if e.complexity.UpdateRiskPayload.Risk == nil {
+			break
+		}
+
+		return e.complexity.UpdateRiskPayload.Risk(childComplexity), true
+
 	case "UpdateTaskPayload.task":
 		if e.complexity.UpdateTaskPayload.Task == nil {
 			break
@@ -2093,6 +2263,7 @@ func (e *executableSchema) Exec(ctx context.Context) graphql.ResponseHandler {
 		ec.unmarshalInputCreateOrganizationInput,
 		ec.unmarshalInputCreatePeopleInput,
 		ec.unmarshalInputCreatePolicyInput,
+		ec.unmarshalInputCreateRiskInput,
 		ec.unmarshalInputCreateTaskInput,
 		ec.unmarshalInputCreateVendorInput,
 		ec.unmarshalInputDeleteEvidenceInput,
@@ -2100,6 +2271,7 @@ func (e *executableSchema) Exec(ctx context.Context) graphql.ResponseHandler {
 		ec.unmarshalInputDeleteOrganizationInput,
 		ec.unmarshalInputDeletePeopleInput,
 		ec.unmarshalInputDeletePolicyInput,
+		ec.unmarshalInputDeleteRiskInput,
 		ec.unmarshalInputDeleteTaskInput,
 		ec.unmarshalInputDeleteVendorInput,
 		ec.unmarshalInputEvidenceOrder,
@@ -2112,6 +2284,7 @@ func (e *executableSchema) Exec(ctx context.Context) graphql.ResponseHandler {
 		ec.unmarshalInputPeopleOrder,
 		ec.unmarshalInputPolicyOrder,
 		ec.unmarshalInputRemoveUserInput,
+		ec.unmarshalInputRiskOrder,
 		ec.unmarshalInputTaskOrder,
 		ec.unmarshalInputUnassignTaskInput,
 		ec.unmarshalInputUpdateFrameworkInput,
@@ -2119,6 +2292,7 @@ func (e *executableSchema) Exec(ctx context.Context) graphql.ResponseHandler {
 		ec.unmarshalInputUpdateOrganizationInput,
 		ec.unmarshalInputUpdatePeopleInput,
 		ec.unmarshalInputUpdatePolicyInput,
+		ec.unmarshalInputUpdateRiskInput,
 		ec.unmarshalInputUpdateTaskInput,
 		ec.unmarshalInputUpdateVendorInput,
 		ec.unmarshalInputUploadEvidenceInput,
@@ -2438,6 +2612,14 @@ enum PolicyOrderField
   NAME
 }
 
+enum RiskOrderField
+  @goModel(model: "github.com/getprobo/probo/pkg/coredata.RiskOrderField") {
+  CREATED_AT
+    @goEnum(
+      value: "github.com/getprobo/probo/pkg/coredata.RiskOrderFieldCreatedAt"
+    )
+}
+
 enum EvidenceOrderField
   @goModel(model: "github.com/getprobo/probo/pkg/coredata.EvidenceOrderField") {
   CREATED_AT
@@ -2514,6 +2696,14 @@ input PolicyOrder
   field: PolicyOrderField!
 }
 
+input RiskOrder
+  @goModel(
+    model: "github.com/getprobo/probo/pkg/server/api/console/v1/types.RiskOrderBy"
+  ) {
+  direction: OrderDirection!
+  field: RiskOrderField!
+}
+
 input EvidenceOrder
   @goModel(
     model: "github.com/getprobo/probo/pkg/server/api/console/v1/types.EvidenceOrderBy"
@@ -2581,6 +2771,14 @@ type Organization implements Node {
     orderBy: MitigationOrder
   ): MitigationConnection! @goField(forceResolver: true)
 
+  risks(
+    first: Int
+    after: CursorKey
+    last: Int
+    before: CursorKey
+    orderBy: RiskOrder
+  ): RiskConnection! @goField(forceResolver: true)
+
   createdAt: Datetime!
   updatedAt: Datetime!
 }
@@ -2710,6 +2908,14 @@ type Policy implements Node {
   updatedAt: Datetime!
 }
 
+type Risk implements Node {
+  id: ID!
+  name: String!
+  description: String!
+  createdAt: Datetime!
+  updatedAt: Datetime!
+}
+
 type Session {
   id: ID!
   expiresAt: Datetime!
@@ -2829,6 +3035,16 @@ type PolicyEdge {
   node: Policy!
 }
 
+type RiskConnection {
+  edges: [RiskEdge!]!
+  pageInfo: PageInfo!
+}
+
+type RiskEdge {
+  cursor: CursorKey!
+  node: Risk!
+}
+
 # Root Types
 type Query {
   node(id: ID!): Node!
@@ -2880,6 +3096,11 @@ type Mutation {
   assignTask(input: AssignTaskInput!): AssignTaskPayload!
   unassignTask(input: UnassignTaskInput!): UnassignTaskPayload!
 
+  # Risk mutations
+  createRisk(input: CreateRiskInput!): CreateRiskPayload!
+  updateRisk(input: UpdateRiskInput!): UpdateRiskPayload!
+  deleteRisk(input: DeleteRiskInput!): DeleteRiskPayload!
+
   # Evidence mutations
   uploadEvidence(input: UploadEvidenceInput!): UploadEvidencePayload!
   deleteEvidence(input: DeleteEvidenceInput!): DeleteEvidencePayload!
@@ -3027,6 +3248,22 @@ input UnassignTaskInput {
   taskId: ID!
 }
 
+input CreateRiskInput {
+  organizationId: ID!
+  name: String!
+  description: String!
+}
+
+input UpdateRiskInput {
+  id: ID!
+  name: String
+  description: String
+}
+
+input DeleteRiskInput {
+  riskId: ID!
+}
+
 input UploadEvidenceInput {
   taskId: ID!
   name: String!
@@ -3162,6 +3399,18 @@ type UnassignTaskPayload {
   task: Task!
 }
 
+type CreateRiskPayload {
+  riskEdge: RiskEdge!
+}
+
+type UpdateRiskPayload {
+  risk: Risk!
+}
+
+type DeleteRiskPayload {
+  deletedRiskId: ID!
+}
+
 type UploadEvidencePayload {
   evidenceEdge: EvidenceEdge!
 }
@@ -3552,6 +3801,29 @@ func (ec *executionContext) field_Mutation_createPolicy_argsInput(
 	return zeroVal, nil
 }
 
+func (ec *executionContext) field_Mutation_createRisk_args(ctx context.Context, rawArgs map[string]any) (map[string]any, error) {
+	var err error
+	args := map[string]any{}
+	arg0, err := ec.field_Mutation_createRisk_argsInput(ctx, rawArgs)
+	if err != nil {
+		return nil, err
+	}
+	args["input"] = arg0
+	return args, nil
+}
+func (ec *executionContext) field_Mutation_createRisk_argsInput(
+	ctx context.Context,
+	rawArgs map[string]any,
+) (types.CreateRiskInput, error) {
+	ctx = graphql.WithPathContext(ctx, graphql.NewPathWithField("input"))
+	if tmp, ok := rawArgs["input"]; ok {
+		return ec.unmarshalNCreateRiskInput2githubᚗcomᚋgetproboᚋproboᚋpkgᚋserverᚋapiᚋconsoleᚋv1ᚋtypesᚐCreateRiskInput(ctx, tmp)
+	}
+
+	var zeroVal types.CreateRiskInput
+	return zeroVal, nil
+}
+
 func (ec *executionContext) field_Mutation_createTask_args(ctx context.Context, rawArgs map[string]any) (map[string]any, error) {
 	var err error
 	args := map[string]any{}
@@ -3713,6 +3985,29 @@ func (ec *executionContext) field_Mutation_deletePolicy_argsInput(
 	return zeroVal, nil
 }
 
+func (ec *executionContext) field_Mutation_deleteRisk_args(ctx context.Context, rawArgs map[string]any) (map[string]any, error) {
+	var err error
+	args := map[string]any{}
+	arg0, err := ec.field_Mutation_deleteRisk_argsInput(ctx, rawArgs)
+	if err != nil {
+		return nil, err
+	}
+	args["input"] = arg0
+	return args, nil
+}
+func (ec *executionContext) field_Mutation_deleteRisk_argsInput(
+	ctx context.Context,
+	rawArgs map[string]any,
+) (types.DeleteRiskInput, error) {
+	ctx = graphql.WithPathContext(ctx, graphql.NewPathWithField("input"))
+	if tmp, ok := rawArgs["input"]; ok {
+		return ec.unmarshalNDeleteRiskInput2githubᚗcomᚋgetproboᚋproboᚋpkgᚋserverᚋapiᚋconsoleᚋv1ᚋtypesᚐDeleteRiskInput(ctx, tmp)
+	}
+
+	var zeroVal types.DeleteRiskInput
+	return zeroVal, nil
+}
+
 func (ec *executionContext) field_Mutation_deleteTask_args(ctx context.Context, rawArgs map[string]any) (map[string]any, error) {
 	var err error
 	args := map[string]any{}
@@ -3989,6 +4284,29 @@ func (ec *executionContext) field_Mutation_updatePolicy_argsInput(
 	return zeroVal, nil
 }
 
+func (ec *executionContext) field_Mutation_updateRisk_args(ctx context.Context, rawArgs map[string]any) (map[string]any, error) {
+	var err error
+	args := map[string]any{}
+	arg0, err := ec.field_Mutation_updateRisk_argsInput(ctx, rawArgs)
+	if err != nil {
+		return nil, err
+	}
+	args["input"] = arg0
+	return args, nil
+}
+func (ec *executionContext) field_Mutation_updateRisk_argsInput(
+	ctx context.Context,
+	rawArgs map[string]any,
+) (types.UpdateRiskInput, error) {
+	ctx = graphql.WithPathContext(ctx, graphql.NewPathWithField("input"))
+	if tmp, ok := rawArgs["input"]; ok {
+		return ec.unmarshalNUpdateRiskInput2githubᚗcomᚋgetproboᚋproboᚋpkgᚋserverᚋapiᚋconsoleᚋv1ᚋtypesᚐUpdateRiskInput(ctx, tmp)
+	}
+
+	var zeroVal types.UpdateRiskInput
+	return zeroVal, nil
+}
+
 func (ec *executionContext) field_Mutation_updateTask_args(ctx context.Context, rawArgs map[string]any) (map[string]any, error) {
 	var err error
 	args := map[string]any{}
@@ -4438,6 +4756,101 @@ func (ec *executionContext) field_Organization_policies_argsOrderBy(
 	return zeroVal, nil
 }
 
+func (ec *executionContext) field_Organization_risks_args(ctx context.Context, rawArgs map[string]any) (map[string]any, error) {
+	var err error
+	args := map[string]any{}
+	arg0, err := ec.field_Organization_risks_argsFirst(ctx, rawArgs)
+	if err != nil {
+		return nil, err
+	}
+	args["first"] = arg0
+	arg1, err := ec.field_Organization_risks_argsAfter(ctx, rawArgs)
+	if err != nil {
+		return nil, err
+	}
+	args["after"] = arg1
+	arg2, err := ec.field_Organization_risks_argsLast(ctx, rawArgs)
+	if err != nil {
+		return nil, err
+	}
+	args["last"] = arg2
+	arg3, err := ec.field_Organization_risks_argsBefore(ctx, rawArgs)
+	if err != nil {
+		return nil, err
+	}
+	args["before"] = arg3
+	arg4, err := ec.field_Organization_risks_argsOrderBy(ctx, rawArgs)
+	if err != nil {
+		return nil, err
+	}
+	args["orderBy"] = arg4
+	return args, nil
+}
+func (ec *executionContext) field_Organization_risks_argsFirst(
+	ctx context.Context,
+	rawArgs map[string]any,
+) (*int, error) {
+	ctx = graphql.WithPathContext(ctx, graphql.NewPathWithField("first"))
+	if tmp, ok := rawArgs["first"]; ok {
+		return ec.unmarshalOInt2ᚖint(ctx, tmp)
+	}
+
+	var zeroVal *int
+	return zeroVal, nil
+}
+
+func (ec *executionContext) field_Organization_risks_argsAfter(
+	ctx context.Context,
+	rawArgs map[string]any,
+) (*page.CursorKey, error) {
+	ctx = graphql.WithPathContext(ctx, graphql.NewPathWithField("after"))
+	if tmp, ok := rawArgs["after"]; ok {
+		return ec.unmarshalOCursorKey2ᚖgithubᚗcomᚋgetproboᚋproboᚋpkgᚋpageᚐCursorKey(ctx, tmp)
+	}
+
+	var zeroVal *page.CursorKey
+	return zeroVal, nil
+}
+
+func (ec *executionContext) field_Organization_risks_argsLast(
+	ctx context.Context,
+	rawArgs map[string]any,
+) (*int, error) {
+	ctx = graphql.WithPathContext(ctx, graphql.NewPathWithField("last"))
+	if tmp, ok := rawArgs["last"]; ok {
+		return ec.unmarshalOInt2ᚖint(ctx, tmp)
+	}
+
+	var zeroVal *int
+	return zeroVal, nil
+}
+
+func (ec *executionContext) field_Organization_risks_argsBefore(
+	ctx context.Context,
+	rawArgs map[string]any,
+) (*page.CursorKey, error) {
+	ctx = graphql.WithPathContext(ctx, graphql.NewPathWithField("before"))
+	if tmp, ok := rawArgs["before"]; ok {
+		return ec.unmarshalOCursorKey2ᚖgithubᚗcomᚋgetproboᚋproboᚋpkgᚋpageᚐCursorKey(ctx, tmp)
+	}
+
+	var zeroVal *page.CursorKey
+	return zeroVal, nil
+}
+
+func (ec *executionContext) field_Organization_risks_argsOrderBy(
+	ctx context.Context,
+	rawArgs map[string]any,
+) (*types.RiskOrderBy, error) {
+	ctx = graphql.WithPathContext(ctx, graphql.NewPathWithField("orderBy"))
+	if tmp, ok := rawArgs["orderBy"]; ok {
+		return ec.unmarshalORiskOrder2ᚖgithubᚗcomᚋgetproboᚋproboᚋpkgᚋserverᚋapiᚋconsoleᚋv1ᚋtypesᚐRiskOrderBy(ctx, tmp)
+	}
+
+	var zeroVal *types.RiskOrderBy
+	return zeroVal, nil
+}
+
 func (ec *executionContext) field_Organization_users_args(ctx context.Context, rawArgs map[string]any) (map[string]any, error) {
 	var err error
 	args := map[string]any{}
@@ -5792,6 +6205,56 @@ func (ec *executionContext) fieldContext_CreatePolicyPayload_policyEdge(_ contex
 	return fc, nil
 }
 
+func (ec *executionContext) _CreateRiskPayload_riskEdge(ctx context.Context, field graphql.CollectedField, obj *types.CreateRiskPayload) (ret graphql.Marshaler) {
+	fc, err := ec.fieldContext_CreateRiskPayload_riskEdge(ctx, field)
+	if err != nil {
+		return graphql.Null
+	}
+	ctx = graphql.WithFieldContext(ctx, fc)
+	defer func() {
+		if r := recover(); r != nil {
+			ec.Error(ctx, ec.Recover(ctx, r))
+			ret = graphql.Null
+		}
+	}()
+	resTmp, err := ec.ResolverMiddleware(ctx, func(rctx context.Context) (any, error) {
+		ctx = rctx // use context from middleware stack in children
+		return obj.RiskEdge, nil
+	})
+	if err != nil {
+		ec.Error(ctx, err)
+		return graphql.Null
+	}
+	if resTmp == nil {
+		if !graphql.HasFieldError(ctx, fc) {
+			ec.Errorf(ctx, "must not be null")
+		}
+		return graphql.Null
+	}
+	res := resTmp.(*types.RiskEdge)
+	fc.Result = res
+	return ec.marshalNRiskEdge2ᚖgithubᚗcomᚋgetproboᚋproboᚋpkgᚋserverᚋapiᚋconsoleᚋv1ᚋtypesᚐRiskEdge(ctx, field.Selections, res)
+}
+
+func (ec *executionContext) fieldContext_CreateRiskPayload_riskEdge(_ context.Context, field graphql.CollectedField) (fc *graphql.FieldContext, err error) {
+	fc = &graphql.FieldContext{
+		Object:     "CreateRiskPayload",
+		Field:      field,
+		IsMethod:   false,
+		IsResolver: false,
+		Child: func(ctx context.Context, field graphql.CollectedField) (*graphql.FieldContext, error) {
+			switch field.Name {
+			case "cursor":
+				return ec.fieldContext_RiskEdge_cursor(ctx, field)
+			case "node":
+				return ec.fieldContext_RiskEdge_node(ctx, field)
+			}
+			return nil, fmt.Errorf("no field named %q was found under type RiskEdge", field.Name)
+		},
+	}
+	return fc, nil
+}
+
 func (ec *executionContext) _CreateTaskPayload_taskEdge(ctx context.Context, field graphql.CollectedField, obj *types.CreateTaskPayload) (ret graphql.Marshaler) {
 	fc, err := ec.fieldContext_CreateTaskPayload_taskEdge(ctx, field)
 	if err != nil {
@@ -6112,6 +6575,50 @@ func (ec *executionContext) fieldContext_DeletePolicyPayload_deletedPolicyId(_ c
 	return fc, nil
 }
 
+func (ec *executionContext) _DeleteRiskPayload_deletedRiskId(ctx context.Context, field graphql.CollectedField, obj *types.DeleteRiskPayload) (ret graphql.Marshaler) {
+	fc, err := ec.fieldContext_DeleteRiskPayload_deletedRiskId(ctx, field)
+	if err != nil {
+		return graphql.Null
+	}
+	ctx = graphql.WithFieldContext(ctx, fc)
+	defer func() {
+		if r := recover(); r != nil {
+			ec.Error(ctx, ec.Recover(ctx, r))
+			ret = graphql.Null
+		}
+	}()
+	resTmp, err := ec.ResolverMiddleware(ctx, func(rctx context.Context) (any, error) {
+		ctx = rctx // use context from middleware stack in children
+		return obj.DeletedRiskID, nil
+	})
+	if err != nil {
+		ec.Error(ctx, err)
+		return graphql.Null
+	}
+	if resTmp == nil {
+		if !graphql.HasFieldError(ctx, fc) {
+			ec.Errorf(ctx, "must not be null")
+		}
+		return graphql.Null
+	}
+	res := resTmp.(gid.GID)
+	fc.Result = res
+	return ec.marshalNID2githubᚗcomᚋgetproboᚋproboᚋpkgᚋgidᚐGID(ctx, field.Selections, res)
+}
+
+func (ec *executionContext) fieldContext_DeleteRiskPayload_deletedRiskId(_ context.Context, field graphql.CollectedField) (fc *graphql.FieldContext, err error) {
+	fc = &graphql.FieldContext{
+		Object:     "DeleteRiskPayload",
+		Field:      field,
+		IsMethod:   false,
+		IsResolver: false,
+		Child: func(ctx context.Context, field graphql.CollectedField) (*graphql.FieldContext, error) {
+			return nil, errors.New("field of type ID does not have child fields")
+		},
+	}
+	return fc, nil
+}
+
 func (ec *executionContext) _DeleteTaskPayload_deletedTaskId(ctx context.Context, field graphql.CollectedField, obj *types.DeleteTaskPayload) (ret graphql.Marshaler) {
 	fc, err := ec.fieldContext_DeleteTaskPayload_deletedTaskId(ctx, field)
 	if err != nil {
@@ -9566,6 +10073,183 @@ func (ec *executionContext) fieldContext_Mutation_unassignTask(ctx context.Conte
 	return fc, nil
 }
 
+func (ec *executionContext) _Mutation_createRisk(ctx context.Context, field graphql.CollectedField) (ret graphql.Marshaler) {
+	fc, err := ec.fieldContext_Mutation_createRisk(ctx, field)
+	if err != nil {
+		return graphql.Null
+	}
+	ctx = graphql.WithFieldContext(ctx, fc)
+	defer func() {
+		if r := recover(); r != nil {
+			ec.Error(ctx, ec.Recover(ctx, r))
+			ret = graphql.Null
+		}
+	}()
+	resTmp, err := ec.ResolverMiddleware(ctx, func(rctx context.Context) (any, error) {
+		ctx = rctx // use context from middleware stack in children
+		return ec.resolvers.Mutation().CreateRisk(rctx, fc.Args["input"].(types.CreateRiskInput))
+	})
+	if err != nil {
+		ec.Error(ctx, err)
+		return graphql.Null
+	}
+	if resTmp == nil {
+		if !graphql.HasFieldError(ctx, fc) {
+			ec.Errorf(ctx, "must not be null")
+		}
+		return graphql.Null
+	}
+	res := resTmp.(*types.CreateRiskPayload)
+	fc.Result = res
+	return ec.marshalNCreateRiskPayload2ᚖgithubᚗcomᚋgetproboᚋproboᚋpkgᚋserverᚋapiᚋconsoleᚋv1ᚋtypesᚐCreateRiskPayload(ctx, field.Selections, res)
+}
+
+func (ec *executionContext) fieldContext_Mutation_createRisk(ctx context.Context, field graphql.CollectedField) (fc *graphql.FieldContext, err error) {
+	fc = &graphql.FieldContext{
+		Object:     "Mutation",
+		Field:      field,
+		IsMethod:   true,
+		IsResolver: true,
+		Child: func(ctx context.Context, field graphql.CollectedField) (*graphql.FieldContext, error) {
+			switch field.Name {
+			case "riskEdge":
+				return ec.fieldContext_CreateRiskPayload_riskEdge(ctx, field)
+			}
+			return nil, fmt.Errorf("no field named %q was found under type CreateRiskPayload", field.Name)
+		},
+	}
+	defer func() {
+		if r := recover(); r != nil {
+			err = ec.Recover(ctx, r)
+			ec.Error(ctx, err)
+		}
+	}()
+	ctx = graphql.WithFieldContext(ctx, fc)
+	if fc.Args, err = ec.field_Mutation_createRisk_args(ctx, field.ArgumentMap(ec.Variables)); err != nil {
+		ec.Error(ctx, err)
+		return fc, err
+	}
+	return fc, nil
+}
+
+func (ec *executionContext) _Mutation_updateRisk(ctx context.Context, field graphql.CollectedField) (ret graphql.Marshaler) {
+	fc, err := ec.fieldContext_Mutation_updateRisk(ctx, field)
+	if err != nil {
+		return graphql.Null
+	}
+	ctx = graphql.WithFieldContext(ctx, fc)
+	defer func() {
+		if r := recover(); r != nil {
+			ec.Error(ctx, ec.Recover(ctx, r))
+			ret = graphql.Null
+		}
+	}()
+	resTmp, err := ec.ResolverMiddleware(ctx, func(rctx context.Context) (any, error) {
+		ctx = rctx // use context from middleware stack in children
+		return ec.resolvers.Mutation().UpdateRisk(rctx, fc.Args["input"].(types.UpdateRiskInput))
+	})
+	if err != nil {
+		ec.Error(ctx, err)
+		return graphql.Null
+	}
+	if resTmp == nil {
+		if !graphql.HasFieldError(ctx, fc) {
+			ec.Errorf(ctx, "must not be null")
+		}
+		return graphql.Null
+	}
+	res := resTmp.(*types.UpdateRiskPayload)
+	fc.Result = res
+	return ec.marshalNUpdateRiskPayload2ᚖgithubᚗcomᚋgetproboᚋproboᚋpkgᚋserverᚋapiᚋconsoleᚋv1ᚋtypesᚐUpdateRiskPayload(ctx, field.Selections, res)
+}
+
+func (ec *executionContext) fieldContext_Mutation_updateRisk(ctx context.Context, field graphql.CollectedField) (fc *graphql.FieldContext, err error) {
+	fc = &graphql.FieldContext{
+		Object:     "Mutation",
+		Field:      field,
+		IsMethod:   true,
+		IsResolver: true,
+		Child: func(ctx context.Context, field graphql.CollectedField) (*graphql.FieldContext, error) {
+			switch field.Name {
+			case "risk":
+				return ec.fieldContext_UpdateRiskPayload_risk(ctx, field)
+			}
+			return nil, fmt.Errorf("no field named %q was found under type UpdateRiskPayload", field.Name)
+		},
+	}
+	defer func() {
+		if r := recover(); r != nil {
+			err = ec.Recover(ctx, r)
+			ec.Error(ctx, err)
+		}
+	}()
+	ctx = graphql.WithFieldContext(ctx, fc)
+	if fc.Args, err = ec.field_Mutation_updateRisk_args(ctx, field.ArgumentMap(ec.Variables)); err != nil {
+		ec.Error(ctx, err)
+		return fc, err
+	}
+	return fc, nil
+}
+
+func (ec *executionContext) _Mutation_deleteRisk(ctx context.Context, field graphql.CollectedField) (ret graphql.Marshaler) {
+	fc, err := ec.fieldContext_Mutation_deleteRisk(ctx, field)
+	if err != nil {
+		return graphql.Null
+	}
+	ctx = graphql.WithFieldContext(ctx, fc)
+	defer func() {
+		if r := recover(); r != nil {
+			ec.Error(ctx, ec.Recover(ctx, r))
+			ret = graphql.Null
+		}
+	}()
+	resTmp, err := ec.ResolverMiddleware(ctx, func(rctx context.Context) (any, error) {
+		ctx = rctx // use context from middleware stack in children
+		return ec.resolvers.Mutation().DeleteRisk(rctx, fc.Args["input"].(types.DeleteRiskInput))
+	})
+	if err != nil {
+		ec.Error(ctx, err)
+		return graphql.Null
+	}
+	if resTmp == nil {
+		if !graphql.HasFieldError(ctx, fc) {
+			ec.Errorf(ctx, "must not be null")
+		}
+		return graphql.Null
+	}
+	res := resTmp.(*types.DeleteRiskPayload)
+	fc.Result = res
+	return ec.marshalNDeleteRiskPayload2ᚖgithubᚗcomᚋgetproboᚋproboᚋpkgᚋserverᚋapiᚋconsoleᚋv1ᚋtypesᚐDeleteRiskPayload(ctx, field.Selections, res)
+}
+
+func (ec *executionContext) fieldContext_Mutation_deleteRisk(ctx context.Context, field graphql.CollectedField) (fc *graphql.FieldContext, err error) {
+	fc = &graphql.FieldContext{
+		Object:     "Mutation",
+		Field:      field,
+		IsMethod:   true,
+		IsResolver: true,
+		Child: func(ctx context.Context, field graphql.CollectedField) (*graphql.FieldContext, error) {
+			switch field.Name {
+			case "deletedRiskId":
+				return ec.fieldContext_DeleteRiskPayload_deletedRiskId(ctx, field)
+			}
+			return nil, fmt.Errorf("no field named %q was found under type DeleteRiskPayload", field.Name)
+		},
+	}
+	defer func() {
+		if r := recover(); r != nil {
+			err = ec.Recover(ctx, r)
+			ec.Error(ctx, err)
+		}
+	}()
+	ctx = graphql.WithFieldContext(ctx, fc)
+	if fc.Args, err = ec.field_Mutation_deleteRisk_args(ctx, field.ArgumentMap(ec.Variables)); err != nil {
+		ec.Error(ctx, err)
+		return fc, err
+	}
+	return fc, nil
+}
+
 func (ec *executionContext) _Mutation_uploadEvidence(ctx context.Context, field graphql.CollectedField) (ret graphql.Marshaler) {
 	fc, err := ec.fieldContext_Mutation_uploadEvidence(ctx, field)
 	if err != nil {
@@ -10356,6 +11040,67 @@ func (ec *executionContext) fieldContext_Organization_mitigations(ctx context.Co
 	return fc, nil
 }
 
+func (ec *executionContext) _Organization_risks(ctx context.Context, field graphql.CollectedField, obj *types.Organization) (ret graphql.Marshaler) {
+	fc, err := ec.fieldContext_Organization_risks(ctx, field)
+	if err != nil {
+		return graphql.Null
+	}
+	ctx = graphql.WithFieldContext(ctx, fc)
+	defer func() {
+		if r := recover(); r != nil {
+			ec.Error(ctx, ec.Recover(ctx, r))
+			ret = graphql.Null
+		}
+	}()
+	resTmp, err := ec.ResolverMiddleware(ctx, func(rctx context.Context) (any, error) {
+		ctx = rctx // use context from middleware stack in children
+		return ec.resolvers.Organization().Risks(rctx, obj, fc.Args["first"].(*int), fc.Args["after"].(*page.CursorKey), fc.Args["last"].(*int), fc.Args["before"].(*page.CursorKey), fc.Args["orderBy"].(*types.RiskOrderBy))
+	})
+	if err != nil {
+		ec.Error(ctx, err)
+		return graphql.Null
+	}
+	if resTmp == nil {
+		if !graphql.HasFieldError(ctx, fc) {
+			ec.Errorf(ctx, "must not be null")
+		}
+		return graphql.Null
+	}
+	res := resTmp.(*types.RiskConnection)
+	fc.Result = res
+	return ec.marshalNRiskConnection2ᚖgithubᚗcomᚋgetproboᚋproboᚋpkgᚋserverᚋapiᚋconsoleᚋv1ᚋtypesᚐRiskConnection(ctx, field.Selections, res)
+}
+
+func (ec *executionContext) fieldContext_Organization_risks(ctx context.Context, field graphql.CollectedField) (fc *graphql.FieldContext, err error) {
+	fc = &graphql.FieldContext{
+		Object:     "Organization",
+		Field:      field,
+		IsMethod:   true,
+		IsResolver: true,
+		Child: func(ctx context.Context, field graphql.CollectedField) (*graphql.FieldContext, error) {
+			switch field.Name {
+			case "edges":
+				return ec.fieldContext_RiskConnection_edges(ctx, field)
+			case "pageInfo":
+				return ec.fieldContext_RiskConnection_pageInfo(ctx, field)
+			}
+			return nil, fmt.Errorf("no field named %q was found under type RiskConnection", field.Name)
+		},
+	}
+	defer func() {
+		if r := recover(); r != nil {
+			err = ec.Recover(ctx, r)
+			ec.Error(ctx, err)
+		}
+	}()
+	ctx = graphql.WithFieldContext(ctx, fc)
+	if fc.Args, err = ec.field_Organization_risks_args(ctx, field.ArgumentMap(ec.Variables)); err != nil {
+		ec.Error(ctx, err)
+		return fc, err
+	}
+	return fc, nil
+}
+
 func (ec *executionContext) _Organization_createdAt(ctx context.Context, field graphql.CollectedField, obj *types.Organization) (ret graphql.Marshaler) {
 	fc, err := ec.fieldContext_Organization_createdAt(ctx, field)
 	if err != nil {
@@ -10649,6 +11394,8 @@ func (ec *executionContext) fieldContext_OrganizationEdge_node(_ context.Context
 				return ec.fieldContext_Organization_policies(ctx, field)
 			case "mitigations":
 				return ec.fieldContext_Organization_mitigations(ctx, field)
+			case "risks":
+				return ec.fieldContext_Organization_risks(ctx, field)
 			case "createdAt":
 				return ec.fieldContext_Organization_createdAt(ctx, field)
 			case "updatedAt":
@@ -12203,6 +12950,430 @@ func (ec *executionContext) fieldContext_RemoveUserPayload_success(_ context.Con
 	return fc, nil
 }
 
+func (ec *executionContext) _Risk_id(ctx context.Context, field graphql.CollectedField, obj *types.Risk) (ret graphql.Marshaler) {
+	fc, err := ec.fieldContext_Risk_id(ctx, field)
+	if err != nil {
+		return graphql.Null
+	}
+	ctx = graphql.WithFieldContext(ctx, fc)
+	defer func() {
+		if r := recover(); r != nil {
+			ec.Error(ctx, ec.Recover(ctx, r))
+			ret = graphql.Null
+		}
+	}()
+	resTmp, err := ec.ResolverMiddleware(ctx, func(rctx context.Context) (any, error) {
+		ctx = rctx // use context from middleware stack in children
+		return obj.ID, nil
+	})
+	if err != nil {
+		ec.Error(ctx, err)
+		return graphql.Null
+	}
+	if resTmp == nil {
+		if !graphql.HasFieldError(ctx, fc) {
+			ec.Errorf(ctx, "must not be null")
+		}
+		return graphql.Null
+	}
+	res := resTmp.(gid.GID)
+	fc.Result = res
+	return ec.marshalNID2githubᚗcomᚋgetproboᚋproboᚋpkgᚋgidᚐGID(ctx, field.Selections, res)
+}
+
+func (ec *executionContext) fieldContext_Risk_id(_ context.Context, field graphql.CollectedField) (fc *graphql.FieldContext, err error) {
+	fc = &graphql.FieldContext{
+		Object:     "Risk",
+		Field:      field,
+		IsMethod:   false,
+		IsResolver: false,
+		Child: func(ctx context.Context, field graphql.CollectedField) (*graphql.FieldContext, error) {
+			return nil, errors.New("field of type ID does not have child fields")
+		},
+	}
+	return fc, nil
+}
+
+func (ec *executionContext) _Risk_name(ctx context.Context, field graphql.CollectedField, obj *types.Risk) (ret graphql.Marshaler) {
+	fc, err := ec.fieldContext_Risk_name(ctx, field)
+	if err != nil {
+		return graphql.Null
+	}
+	ctx = graphql.WithFieldContext(ctx, fc)
+	defer func() {
+		if r := recover(); r != nil {
+			ec.Error(ctx, ec.Recover(ctx, r))
+			ret = graphql.Null
+		}
+	}()
+	resTmp, err := ec.ResolverMiddleware(ctx, func(rctx context.Context) (any, error) {
+		ctx = rctx // use context from middleware stack in children
+		return obj.Name, nil
+	})
+	if err != nil {
+		ec.Error(ctx, err)
+		return graphql.Null
+	}
+	if resTmp == nil {
+		if !graphql.HasFieldError(ctx, fc) {
+			ec.Errorf(ctx, "must not be null")
+		}
+		return graphql.Null
+	}
+	res := resTmp.(string)
+	fc.Result = res
+	return ec.marshalNString2string(ctx, field.Selections, res)
+}
+
+func (ec *executionContext) fieldContext_Risk_name(_ context.Context, field graphql.CollectedField) (fc *graphql.FieldContext, err error) {
+	fc = &graphql.FieldContext{
+		Object:     "Risk",
+		Field:      field,
+		IsMethod:   false,
+		IsResolver: false,
+		Child: func(ctx context.Context, field graphql.CollectedField) (*graphql.FieldContext, error) {
+			return nil, errors.New("field of type String does not have child fields")
+		},
+	}
+	return fc, nil
+}
+
+func (ec *executionContext) _Risk_description(ctx context.Context, field graphql.CollectedField, obj *types.Risk) (ret graphql.Marshaler) {
+	fc, err := ec.fieldContext_Risk_description(ctx, field)
+	if err != nil {
+		return graphql.Null
+	}
+	ctx = graphql.WithFieldContext(ctx, fc)
+	defer func() {
+		if r := recover(); r != nil {
+			ec.Error(ctx, ec.Recover(ctx, r))
+			ret = graphql.Null
+		}
+	}()
+	resTmp, err := ec.ResolverMiddleware(ctx, func(rctx context.Context) (any, error) {
+		ctx = rctx // use context from middleware stack in children
+		return obj.Description, nil
+	})
+	if err != nil {
+		ec.Error(ctx, err)
+		return graphql.Null
+	}
+	if resTmp == nil {
+		if !graphql.HasFieldError(ctx, fc) {
+			ec.Errorf(ctx, "must not be null")
+		}
+		return graphql.Null
+	}
+	res := resTmp.(string)
+	fc.Result = res
+	return ec.marshalNString2string(ctx, field.Selections, res)
+}
+
+func (ec *executionContext) fieldContext_Risk_description(_ context.Context, field graphql.CollectedField) (fc *graphql.FieldContext, err error) {
+	fc = &graphql.FieldContext{
+		Object:     "Risk",
+		Field:      field,
+		IsMethod:   false,
+		IsResolver: false,
+		Child: func(ctx context.Context, field graphql.CollectedField) (*graphql.FieldContext, error) {
+			return nil, errors.New("field of type String does not have child fields")
+		},
+	}
+	return fc, nil
+}
+
+func (ec *executionContext) _Risk_createdAt(ctx context.Context, field graphql.CollectedField, obj *types.Risk) (ret graphql.Marshaler) {
+	fc, err := ec.fieldContext_Risk_createdAt(ctx, field)
+	if err != nil {
+		return graphql.Null
+	}
+	ctx = graphql.WithFieldContext(ctx, fc)
+	defer func() {
+		if r := recover(); r != nil {
+			ec.Error(ctx, ec.Recover(ctx, r))
+			ret = graphql.Null
+		}
+	}()
+	resTmp, err := ec.ResolverMiddleware(ctx, func(rctx context.Context) (any, error) {
+		ctx = rctx // use context from middleware stack in children
+		return obj.CreatedAt, nil
+	})
+	if err != nil {
+		ec.Error(ctx, err)
+		return graphql.Null
+	}
+	if resTmp == nil {
+		if !graphql.HasFieldError(ctx, fc) {
+			ec.Errorf(ctx, "must not be null")
+		}
+		return graphql.Null
+	}
+	res := resTmp.(time.Time)
+	fc.Result = res
+	return ec.marshalNDatetime2timeᚐTime(ctx, field.Selections, res)
+}
+
+func (ec *executionContext) fieldContext_Risk_createdAt(_ context.Context, field graphql.CollectedField) (fc *graphql.FieldContext, err error) {
+	fc = &graphql.FieldContext{
+		Object:     "Risk",
+		Field:      field,
+		IsMethod:   false,
+		IsResolver: false,
+		Child: func(ctx context.Context, field graphql.CollectedField) (*graphql.FieldContext, error) {
+			return nil, errors.New("field of type Datetime does not have child fields")
+		},
+	}
+	return fc, nil
+}
+
+func (ec *executionContext) _Risk_updatedAt(ctx context.Context, field graphql.CollectedField, obj *types.Risk) (ret graphql.Marshaler) {
+	fc, err := ec.fieldContext_Risk_updatedAt(ctx, field)
+	if err != nil {
+		return graphql.Null
+	}
+	ctx = graphql.WithFieldContext(ctx, fc)
+	defer func() {
+		if r := recover(); r != nil {
+			ec.Error(ctx, ec.Recover(ctx, r))
+			ret = graphql.Null
+		}
+	}()
+	resTmp, err := ec.ResolverMiddleware(ctx, func(rctx context.Context) (any, error) {
+		ctx = rctx // use context from middleware stack in children
+		return obj.UpdatedAt, nil
+	})
+	if err != nil {
+		ec.Error(ctx, err)
+		return graphql.Null
+	}
+	if resTmp == nil {
+		if !graphql.HasFieldError(ctx, fc) {
+			ec.Errorf(ctx, "must not be null")
+		}
+		return graphql.Null
+	}
+	res := resTmp.(time.Time)
+	fc.Result = res
+	return ec.marshalNDatetime2timeᚐTime(ctx, field.Selections, res)
+}
+
+func (ec *executionContext) fieldContext_Risk_updatedAt(_ context.Context, field graphql.CollectedField) (fc *graphql.FieldContext, err error) {
+	fc = &graphql.FieldContext{
+		Object:     "Risk",
+		Field:      field,
+		IsMethod:   false,
+		IsResolver: false,
+		Child: func(ctx context.Context, field graphql.CollectedField) (*graphql.FieldContext, error) {
+			return nil, errors.New("field of type Datetime does not have child fields")
+		},
+	}
+	return fc, nil
+}
+
+func (ec *executionContext) _RiskConnection_edges(ctx context.Context, field graphql.CollectedField, obj *types.RiskConnection) (ret graphql.Marshaler) {
+	fc, err := ec.fieldContext_RiskConnection_edges(ctx, field)
+	if err != nil {
+		return graphql.Null
+	}
+	ctx = graphql.WithFieldContext(ctx, fc)
+	defer func() {
+		if r := recover(); r != nil {
+			ec.Error(ctx, ec.Recover(ctx, r))
+			ret = graphql.Null
+		}
+	}()
+	resTmp, err := ec.ResolverMiddleware(ctx, func(rctx context.Context) (any, error) {
+		ctx = rctx // use context from middleware stack in children
+		return obj.Edges, nil
+	})
+	if err != nil {
+		ec.Error(ctx, err)
+		return graphql.Null
+	}
+	if resTmp == nil {
+		if !graphql.HasFieldError(ctx, fc) {
+			ec.Errorf(ctx, "must not be null")
+		}
+		return graphql.Null
+	}
+	res := resTmp.([]*types.RiskEdge)
+	fc.Result = res
+	return ec.marshalNRiskEdge2ᚕᚖgithubᚗcomᚋgetproboᚋproboᚋpkgᚋserverᚋapiᚋconsoleᚋv1ᚋtypesᚐRiskEdgeᚄ(ctx, field.Selections, res)
+}
+
+func (ec *executionContext) fieldContext_RiskConnection_edges(_ context.Context, field graphql.CollectedField) (fc *graphql.FieldContext, err error) {
+	fc = &graphql.FieldContext{
+		Object:     "RiskConnection",
+		Field:      field,
+		IsMethod:   false,
+		IsResolver: false,
+		Child: func(ctx context.Context, field graphql.CollectedField) (*graphql.FieldContext, error) {
+			switch field.Name {
+			case "cursor":
+				return ec.fieldContext_RiskEdge_cursor(ctx, field)
+			case "node":
+				return ec.fieldContext_RiskEdge_node(ctx, field)
+			}
+			return nil, fmt.Errorf("no field named %q was found under type RiskEdge", field.Name)
+		},
+	}
+	return fc, nil
+}
+
+func (ec *executionContext) _RiskConnection_pageInfo(ctx context.Context, field graphql.CollectedField, obj *types.RiskConnection) (ret graphql.Marshaler) {
+	fc, err := ec.fieldContext_RiskConnection_pageInfo(ctx, field)
+	if err != nil {
+		return graphql.Null
+	}
+	ctx = graphql.WithFieldContext(ctx, fc)
+	defer func() {
+		if r := recover(); r != nil {
+			ec.Error(ctx, ec.Recover(ctx, r))
+			ret = graphql.Null
+		}
+	}()
+	resTmp, err := ec.ResolverMiddleware(ctx, func(rctx context.Context) (any, error) {
+		ctx = rctx // use context from middleware stack in children
+		return obj.PageInfo, nil
+	})
+	if err != nil {
+		ec.Error(ctx, err)
+		return graphql.Null
+	}
+	if resTmp == nil {
+		if !graphql.HasFieldError(ctx, fc) {
+			ec.Errorf(ctx, "must not be null")
+		}
+		return graphql.Null
+	}
+	res := resTmp.(*types.PageInfo)
+	fc.Result = res
+	return ec.marshalNPageInfo2ᚖgithubᚗcomᚋgetproboᚋproboᚋpkgᚋserverᚋapiᚋconsoleᚋv1ᚋtypesᚐPageInfo(ctx, field.Selections, res)
+}
+
+func (ec *executionContext) fieldContext_RiskConnection_pageInfo(_ context.Context, field graphql.CollectedField) (fc *graphql.FieldContext, err error) {
+	fc = &graphql.FieldContext{
+		Object:     "RiskConnection",
+		Field:      field,
+		IsMethod:   false,
+		IsResolver: false,
+		Child: func(ctx context.Context, field graphql.CollectedField) (*graphql.FieldContext, error) {
+			switch field.Name {
+			case "hasNextPage":
+				return ec.fieldContext_PageInfo_hasNextPage(ctx, field)
+			case "hasPreviousPage":
+				return ec.fieldContext_PageInfo_hasPreviousPage(ctx, field)
+			case "startCursor":
+				return ec.fieldContext_PageInfo_startCursor(ctx, field)
+			case "endCursor":
+				return ec.fieldContext_PageInfo_endCursor(ctx, field)
+			}
+			return nil, fmt.Errorf("no field named %q was found under type PageInfo", field.Name)
+		},
+	}
+	return fc, nil
+}
+
+func (ec *executionContext) _RiskEdge_cursor(ctx context.Context, field graphql.CollectedField, obj *types.RiskEdge) (ret graphql.Marshaler) {
+	fc, err := ec.fieldContext_RiskEdge_cursor(ctx, field)
+	if err != nil {
+		return graphql.Null
+	}
+	ctx = graphql.WithFieldContext(ctx, fc)
+	defer func() {
+		if r := recover(); r != nil {
+			ec.Error(ctx, ec.Recover(ctx, r))
+			ret = graphql.Null
+		}
+	}()
+	resTmp, err := ec.ResolverMiddleware(ctx, func(rctx context.Context) (any, error) {
+		ctx = rctx // use context from middleware stack in children
+		return obj.Cursor, nil
+	})
+	if err != nil {
+		ec.Error(ctx, err)
+		return graphql.Null
+	}
+	if resTmp == nil {
+		if !graphql.HasFieldError(ctx, fc) {
+			ec.Errorf(ctx, "must not be null")
+		}
+		return graphql.Null
+	}
+	res := resTmp.(page.CursorKey)
+	fc.Result = res
+	return ec.marshalNCursorKey2githubᚗcomᚋgetproboᚋproboᚋpkgᚋpageᚐCursorKey(ctx, field.Selections, res)
+}
+
+func (ec *executionContext) fieldContext_RiskEdge_cursor(_ context.Context, field graphql.CollectedField) (fc *graphql.FieldContext, err error) {
+	fc = &graphql.FieldContext{
+		Object:     "RiskEdge",
+		Field:      field,
+		IsMethod:   false,
+		IsResolver: false,
+		Child: func(ctx context.Context, field graphql.CollectedField) (*graphql.FieldContext, error) {
+			return nil, errors.New("field of type CursorKey does not have child fields")
+		},
+	}
+	return fc, nil
+}
+
+func (ec *executionContext) _RiskEdge_node(ctx context.Context, field graphql.CollectedField, obj *types.RiskEdge) (ret graphql.Marshaler) {
+	fc, err := ec.fieldContext_RiskEdge_node(ctx, field)
+	if err != nil {
+		return graphql.Null
+	}
+	ctx = graphql.WithFieldContext(ctx, fc)
+	defer func() {
+		if r := recover(); r != nil {
+			ec.Error(ctx, ec.Recover(ctx, r))
+			ret = graphql.Null
+		}
+	}()
+	resTmp, err := ec.ResolverMiddleware(ctx, func(rctx context.Context) (any, error) {
+		ctx = rctx // use context from middleware stack in children
+		return obj.Node, nil
+	})
+	if err != nil {
+		ec.Error(ctx, err)
+		return graphql.Null
+	}
+	if resTmp == nil {
+		if !graphql.HasFieldError(ctx, fc) {
+			ec.Errorf(ctx, "must not be null")
+		}
+		return graphql.Null
+	}
+	res := resTmp.(*types.Risk)
+	fc.Result = res
+	return ec.marshalNRisk2ᚖgithubᚗcomᚋgetproboᚋproboᚋpkgᚋserverᚋapiᚋconsoleᚋv1ᚋtypesᚐRisk(ctx, field.Selections, res)
+}
+
+func (ec *executionContext) fieldContext_RiskEdge_node(_ context.Context, field graphql.CollectedField) (fc *graphql.FieldContext, err error) {
+	fc = &graphql.FieldContext{
+		Object:     "RiskEdge",
+		Field:      field,
+		IsMethod:   false,
+		IsResolver: false,
+		Child: func(ctx context.Context, field graphql.CollectedField) (*graphql.FieldContext, error) {
+			switch field.Name {
+			case "id":
+				return ec.fieldContext_Risk_id(ctx, field)
+			case "name":
+				return ec.fieldContext_Risk_name(ctx, field)
+			case "description":
+				return ec.fieldContext_Risk_description(ctx, field)
+			case "createdAt":
+				return ec.fieldContext_Risk_createdAt(ctx, field)
+			case "updatedAt":
+				return ec.fieldContext_Risk_updatedAt(ctx, field)
+			}
+			return nil, fmt.Errorf("no field named %q was found under type Risk", field.Name)
+		},
+	}
+	return fc, nil
+}
+
 func (ec *executionContext) _Session_id(ctx context.Context, field graphql.CollectedField, obj *types.Session) (ret graphql.Marshaler) {
 	fc, err := ec.fieldContext_Session_id(ctx, field)
 	if err != nil {
@@ -13169,6 +14340,8 @@ func (ec *executionContext) fieldContext_UpdateOrganizationPayload_organization(
 				return ec.fieldContext_Organization_policies(ctx, field)
 			case "mitigations":
 				return ec.fieldContext_Organization_mitigations(ctx, field)
+			case "risks":
+				return ec.fieldContext_Organization_risks(ctx, field)
 			case "createdAt":
 				return ec.fieldContext_Organization_createdAt(ctx, field)
 			case "updatedAt":
@@ -13302,6 +14475,62 @@ func (ec *executionContext) fieldContext_UpdatePolicyPayload_policy(_ context.Co
 	return fc, nil
 }
 
+func (ec *executionContext) _UpdateRiskPayload_risk(ctx context.Context, field graphql.CollectedField, obj *types.UpdateRiskPayload) (ret graphql.Marshaler) {
+	fc, err := ec.fieldContext_UpdateRiskPayload_risk(ctx, field)
+	if err != nil {
+		return graphql.Null
+	}
+	ctx = graphql.WithFieldContext(ctx, fc)
+	defer func() {
+		if r := recover(); r != nil {
+			ec.Error(ctx, ec.Recover(ctx, r))
+			ret = graphql.Null
+		}
+	}()
+	resTmp, err := ec.ResolverMiddleware(ctx, func(rctx context.Context) (any, error) {
+		ctx = rctx // use context from middleware stack in children
+		return obj.Risk, nil
+	})
+	if err != nil {
+		ec.Error(ctx, err)
+		return graphql.Null
+	}
+	if resTmp == nil {
+		if !graphql.HasFieldError(ctx, fc) {
+			ec.Errorf(ctx, "must not be null")
+		}
+		return graphql.Null
+	}
+	res := resTmp.(*types.Risk)
+	fc.Result = res
+	return ec.marshalNRisk2ᚖgithubᚗcomᚋgetproboᚋproboᚋpkgᚋserverᚋapiᚋconsoleᚋv1ᚋtypesᚐRisk(ctx, field.Selections, res)
+}
+
+func (ec *executionContext) fieldContext_UpdateRiskPayload_risk(_ context.Context, field graphql.CollectedField) (fc *graphql.FieldContext, err error) {
+	fc = &graphql.FieldContext{
+		Object:     "UpdateRiskPayload",
+		Field:      field,
+		IsMethod:   false,
+		IsResolver: false,
+		Child: func(ctx context.Context, field graphql.CollectedField) (*graphql.FieldContext, error) {
+			switch field.Name {
+			case "id":
+				return ec.fieldContext_Risk_id(ctx, field)
+			case "name":
+				return ec.fieldContext_Risk_name(ctx, field)
+			case "description":
+				return ec.fieldContext_Risk_description(ctx, field)
+			case "createdAt":
+				return ec.fieldContext_Risk_createdAt(ctx, field)
+			case "updatedAt":
+				return ec.fieldContext_Risk_updatedAt(ctx, field)
+			}
+			return nil, fmt.Errorf("no field named %q was found under type Risk", field.Name)
+		},
+	}
+	return fc, nil
+}
+
 func (ec *executionContext) _UpdateTaskPayload_task(ctx context.Context, field graphql.CollectedField, obj *types.UpdateTaskPayload) (ret graphql.Marshaler) {
 	fc, err := ec.fieldContext_UpdateTaskPayload_task(ctx, field)
 	if err != nil {
@@ -17091,6 +18320,47 @@ func (ec *executionContext) unmarshalInputCreatePolicyInput(ctx context.Context,
 	return it, nil
 }
 
+func (ec *executionContext) unmarshalInputCreateRiskInput(ctx context.Context, obj any) (types.CreateRiskInput, error) {
+	var it types.CreateRiskInput
+	asMap := map[string]any{}
+	for k, v := range obj.(map[string]any) {
+		asMap[k] = v
+	}
+
+	fieldsInOrder := [...]string{"organizationId", "name", "description"}
+	for _, k := range fieldsInOrder {
+		v, ok := asMap[k]
+		if !ok {
+			continue
+		}
+		switch k {
+		case "organizationId":
+			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("organizationId"))
+			data, err := ec.unmarshalNID2githubᚗcomᚋgetproboᚋproboᚋpkgᚋgidᚐGID(ctx, v)
+			if err != nil {
+				return it, err
+			}
+			it.OrganizationID = data
+		case "name":
+			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("name"))
+			data, err := ec.unmarshalNString2string(ctx, v)
+			if err != nil {
+				return it, err
+			}
+			it.Name = data
+		case "description":
+			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("description"))
+			data, err := ec.unmarshalNString2string(ctx, v)
+			if err != nil {
+				return it, err
+			}
+			it.Description = data
+		}
+	}
+
+	return it, nil
+}
+
 func (ec *executionContext) unmarshalInputCreateTaskInput(ctx context.Context, obj any) (types.CreateTaskInput, error) {
 	var it types.CreateTaskInput
 	asMap := map[string]any{}
@@ -17371,6 +18641,33 @@ func (ec *executionContext) unmarshalInputDeletePolicyInput(ctx context.Context,
 	return it, nil
 }
 
+func (ec *executionContext) unmarshalInputDeleteRiskInput(ctx context.Context, obj any) (types.DeleteRiskInput, error) {
+	var it types.DeleteRiskInput
+	asMap := map[string]any{}
+	for k, v := range obj.(map[string]any) {
+		asMap[k] = v
+	}
+
+	fieldsInOrder := [...]string{"riskId"}
+	for _, k := range fieldsInOrder {
+		v, ok := asMap[k]
+		if !ok {
+			continue
+		}
+		switch k {
+		case "riskId":
+			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("riskId"))
+			data, err := ec.unmarshalNID2githubᚗcomᚋgetproboᚋproboᚋpkgᚋgidᚐGID(ctx, v)
+			if err != nil {
+				return it, err
+			}
+			it.RiskID = data
+		}
+	}
+
+	return it, nil
+}
+
 func (ec *executionContext) unmarshalInputDeleteTaskInput(ctx context.Context, obj any) (types.DeleteTaskInput, error) {
 	var it types.DeleteTaskInput
 	asMap := map[string]any{}
@@ -17772,6 +19069,40 @@ func (ec *executionContext) unmarshalInputRemoveUserInput(ctx context.Context, o
 	return it, nil
 }
 
+func (ec *executionContext) unmarshalInputRiskOrder(ctx context.Context, obj any) (types.RiskOrderBy, error) {
+	var it types.RiskOrderBy
+	asMap := map[string]any{}
+	for k, v := range obj.(map[string]any) {
+		asMap[k] = v
+	}
+
+	fieldsInOrder := [...]string{"direction", "field"}
+	for _, k := range fieldsInOrder {
+		v, ok := asMap[k]
+		if !ok {
+			continue
+		}
+		switch k {
+		case "direction":
+			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("direction"))
+			data, err := ec.unmarshalNOrderDirection2githubᚗcomᚋgetproboᚋproboᚋpkgᚋpageᚐOrderDirection(ctx, v)
+			if err != nil {
+				return it, err
+			}
+			it.Direction = data
+		case "field":
+			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("field"))
+			data, err := ec.unmarshalNRiskOrderField2githubᚗcomᚋgetproboᚋproboᚋpkgᚋcoredataᚐRiskOrderField(ctx, v)
+			if err != nil {
+				return it, err
+			}
+			it.Field = data
+		}
+	}
+
+	return it, nil
+}
+
 func (ec *executionContext) unmarshalInputTaskOrder(ctx context.Context, obj any) (types.TaskOrderBy, error) {
 	var it types.TaskOrderBy
 	asMap := map[string]any{}
@@ -18094,6 +19425,47 @@ func (ec *executionContext) unmarshalInputUpdatePolicyInput(ctx context.Context,
 	return it, nil
 }
 
+func (ec *executionContext) unmarshalInputUpdateRiskInput(ctx context.Context, obj any) (types.UpdateRiskInput, error) {
+	var it types.UpdateRiskInput
+	asMap := map[string]any{}
+	for k, v := range obj.(map[string]any) {
+		asMap[k] = v
+	}
+
+	fieldsInOrder := [...]string{"id", "name", "description"}
+	for _, k := range fieldsInOrder {
+		v, ok := asMap[k]
+		if !ok {
+			continue
+		}
+		switch k {
+		case "id":
+			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("id"))
+			data, err := ec.unmarshalNID2githubᚗcomᚋgetproboᚋproboᚋpkgᚋgidᚐGID(ctx, v)
+			if err != nil {
+				return it, err
+			}
+			it.ID = data
+		case "name":
+			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("name"))
+			data, err := ec.unmarshalOString2ᚖstring(ctx, v)
+			if err != nil {
+				return it, err
+			}
+			it.Name = data
+		case "description":
+			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("description"))
+			data, err := ec.unmarshalOString2ᚖstring(ctx, v)
+			if err != nil {
+				return it, err
+			}
+			it.Description = data
+		}
+	}
+
+	return it, nil
+}
+
 func (ec *executionContext) unmarshalInputUpdateTaskInput(ctx context.Context, obj any) (types.UpdateTaskInput, error) {
 	var it types.UpdateTaskInput
 	asMap := map[string]any{}
@@ -18447,6 +19819,13 @@ func (ec *executionContext) _Node(ctx context.Context, sel ast.SelectionSet, obj
 			return graphql.Null
 		}
 		return ec._Policy(ctx, sel, obj)
+	case types.Risk:
+		return ec._Risk(ctx, sel, &obj)
+	case *types.Risk:
+		if obj == nil {
+			return graphql.Null
+		}
+		return ec._Risk(ctx, sel, obj)
 	default:
 		panic(fmt.Errorf("unexpected type %T", obj))
 	}
@@ -18881,6 +20260,45 @@ func (ec *executionContext) _CreatePolicyPayload(ctx context.Context, sel ast.Se
 	return out
 }
 
+var createRiskPayloadImplementors = []string{"CreateRiskPayload"}
+
+func (ec *executionContext) _CreateRiskPayload(ctx context.Context, sel ast.SelectionSet, obj *types.CreateRiskPayload) graphql.Marshaler {
+	fields := graphql.CollectFields(ec.OperationContext, sel, createRiskPayloadImplementors)
+
+	out := graphql.NewFieldSet(fields)
+	deferred := make(map[string]*graphql.FieldSet)
+	for i, field := range fields {
+		switch field.Name {
+		case "__typename":
+			out.Values[i] = graphql.MarshalString("CreateRiskPayload")
+		case "riskEdge":
+			out.Values[i] = ec._CreateRiskPayload_riskEdge(ctx, field, obj)
+			if out.Values[i] == graphql.Null {
+				out.Invalids++
+			}
+		default:
+			panic("unknown field " + strconv.Quote(field.Name))
+		}
+	}
+	out.Dispatch(ctx)
+	if out.Invalids > 0 {
+		return graphql.Null
+	}
+
+	atomic.AddInt32(&ec.deferred, int32(len(deferred)))
+
+	for label, dfs := range deferred {
+		ec.processDeferredGroup(graphql.DeferredGroup{
+			Label:    label,
+			Path:     graphql.GetPath(ctx),
+			FieldSet: dfs,
+			Context:  ctx,
+		})
+	}
+
+	return out
+}
+
 var createTaskPayloadImplementors = []string{"CreateTaskPayload"}
 
 func (ec *executionContext) _CreateTaskPayload(ctx context.Context, sel ast.SelectionSet, obj *types.CreateTaskPayload) graphql.Marshaler {
@@ -19154,6 +20572,45 @@ func (ec *executionContext) _DeletePolicyPayload(ctx context.Context, sel ast.Se
 	return out
 }
 
+var deleteRiskPayloadImplementors = []string{"DeleteRiskPayload"}
+
+func (ec *executionContext) _DeleteRiskPayload(ctx context.Context, sel ast.SelectionSet, obj *types.DeleteRiskPayload) graphql.Marshaler {
+	fields := graphql.CollectFields(ec.OperationContext, sel, deleteRiskPayloadImplementors)
+
+	out := graphql.NewFieldSet(fields)
+	deferred := make(map[string]*graphql.FieldSet)
+	for i, field := range fields {
+		switch field.Name {
+		case "__typename":
+			out.Values[i] = graphql.MarshalString("DeleteRiskPayload")
+		case "deletedRiskId":
+			out.Values[i] = ec._DeleteRiskPayload_deletedRiskId(ctx, field, obj)
+			if out.Values[i] == graphql.Null {
+				out.Invalids++
+			}
+		default:
+			panic("unknown field " + strconv.Quote(field.Name))
+		}
+	}
+	out.Dispatch(ctx)
+	if out.Invalids > 0 {
+		return graphql.Null
+	}
+
+	atomic.AddInt32(&ec.deferred, int32(len(deferred)))
+
+	for label, dfs := range deferred {
+		ec.processDeferredGroup(graphql.DeferredGroup{
+			Label:    label,
+			Path:     graphql.GetPath(ctx),
+			FieldSet: dfs,
+			Context:  ctx,
+		})
+	}
+
+	return out
+}
+
 var deleteTaskPayloadImplementors = []string{"DeleteTaskPayload"}
 
 func (ec *executionContext) _DeleteTaskPayload(ctx context.Context, sel ast.SelectionSet, obj *types.DeleteTaskPayload) graphql.Marshaler {
@@ -20119,6 +21576,27 @@ func (ec *executionContext) _Mutation(ctx context.Context, sel ast.SelectionSet)
 			if out.Values[i] == graphql.Null {
 				out.Invalids++
 			}
+		case "createRisk":
+			out.Values[i] = ec.OperationContext.RootResolverMiddleware(innerCtx, func(ctx context.Context) (res graphql.Marshaler) {
+				return ec._Mutation_createRisk(ctx, field)
+			})
+			if out.Values[i] == graphql.Null {
+				out.Invalids++
+			}
+		case "updateRisk":
+			out.Values[i] = ec.OperationContext.RootResolverMiddleware(innerCtx, func(ctx context.Context) (res graphql.Marshaler) {
+				return ec._Mutation_updateRisk(ctx, field)
+			})
+			if out.Values[i] == graphql.Null {
+				out.Invalids++
+			}
+		case "deleteRisk":
+			out.Values[i] = ec.OperationContext.RootResolverMiddleware(innerCtx, func(ctx context.Context) (res graphql.Marshaler) {
+				return ec._Mutation_deleteRisk(ctx, field)
+			})
+			if out.Values[i] == graphql.Null {
+				out.Invalids++
+			}
 		case "uploadEvidence":
 			out.Values[i] = ec.OperationContext.RootResolverMiddleware(innerCtx, func(ctx context.Context) (res graphql.Marshaler) {
 				return ec._Mutation_uploadEvidence(ctx, field)
@@ -20446,6 +21924,42 @@ func (ec *executionContext) _Organization(ctx context.Context, sel ast.Selection
 				continue
 			}
 
+			out.Concurrently(i, func(ctx context.Context) graphql.Marshaler { return innerFunc(ctx, out) })
+		case "risks":
+			field := field
+
+			innerFunc := func(ctx context.Context, fs *graphql.FieldSet) (res graphql.Marshaler) {
+				defer func() {
+					if r := recover(); r != nil {
+						ec.Error(ctx, ec.Recover(ctx, r))
+					}
+				}()
+				res = ec._Organization_risks(ctx, field, obj)
+				if res == graphql.Null {
+					atomic.AddUint32(&fs.Invalids, 1)
+				}
+				return res
+			}
+
+			if field.Deferrable != nil {
+				dfs, ok := deferred[field.Deferrable.Label]
+				di := 0
+				if ok {
+					dfs.AddField(field)
+					di = len(dfs.Values) - 1
+				} else {
+					dfs = graphql.NewFieldSet([]graphql.CollectedField{field})
+					deferred[field.Deferrable.Label] = dfs
+				}
+				dfs.Concurrently(di, func(ctx context.Context) graphql.Marshaler {
+					return innerFunc(ctx, dfs)
+				})
+
+				// don't run the out.Concurrently() call below
+				out.Values[i] = graphql.Null
+				continue
+			}
+
 			out.Concurrently(i, func(ctx context.Context) graphql.Marshaler { return innerFunc(ctx, out) })
 		case "createdAt":
 			out.Values[i] = ec._Organization_createdAt(ctx, field, obj)
@@ -21096,6 +22610,153 @@ func (ec *executionContext) _RemoveUserPayload(ctx context.Context, sel ast.Sele
 	return out
 }
 
+var riskImplementors = []string{"Risk", "Node"}
+
+func (ec *executionContext) _Risk(ctx context.Context, sel ast.SelectionSet, obj *types.Risk) graphql.Marshaler {
+	fields := graphql.CollectFields(ec.OperationContext, sel, riskImplementors)
+
+	out := graphql.NewFieldSet(fields)
+	deferred := make(map[string]*graphql.FieldSet)
+	for i, field := range fields {
+		switch field.Name {
+		case "__typename":
+			out.Values[i] = graphql.MarshalString("Risk")
+		case "id":
+			out.Values[i] = ec._Risk_id(ctx, field, obj)
+			if out.Values[i] == graphql.Null {
+				out.Invalids++
+			}
+		case "name":
+			out.Values[i] = ec._Risk_name(ctx, field, obj)
+			if out.Values[i] == graphql.Null {
+				out.Invalids++
+			}
+		case "description":
+			out.Values[i] = ec._Risk_description(ctx, field, obj)
+			if out.Values[i] == graphql.Null {
+				out.Invalids++
+			}
+		case "createdAt":
+			out.Values[i] = ec._Risk_createdAt(ctx, field, obj)
+			if out.Values[i] == graphql.Null {
+				out.Invalids++
+			}
+		case "updatedAt":
+			out.Values[i] = ec._Risk_updatedAt(ctx, field, obj)
+			if out.Values[i] == graphql.Null {
+				out.Invalids++
+			}
+		default:
+			panic("unknown field " + strconv.Quote(field.Name))
+		}
+	}
+	out.Dispatch(ctx)
+	if out.Invalids > 0 {
+		return graphql.Null
+	}
+
+	atomic.AddInt32(&ec.deferred, int32(len(deferred)))
+
+	for label, dfs := range deferred {
+		ec.processDeferredGroup(graphql.DeferredGroup{
+			Label:    label,
+			Path:     graphql.GetPath(ctx),
+			FieldSet: dfs,
+			Context:  ctx,
+		})
+	}
+
+	return out
+}
+
+var riskConnectionImplementors = []string{"RiskConnection"}
+
+func (ec *executionContext) _RiskConnection(ctx context.Context, sel ast.SelectionSet, obj *types.RiskConnection) graphql.Marshaler {
+	fields := graphql.CollectFields(ec.OperationContext, sel, riskConnectionImplementors)
+
+	out := graphql.NewFieldSet(fields)
+	deferred := make(map[string]*graphql.FieldSet)
+	for i, field := range fields {
+		switch field.Name {
+		case "__typename":
+			out.Values[i] = graphql.MarshalString("RiskConnection")
+		case "edges":
+			out.Values[i] = ec._RiskConnection_edges(ctx, field, obj)
+			if out.Values[i] == graphql.Null {
+				out.Invalids++
+			}
+		case "pageInfo":
+			out.Values[i] = ec._RiskConnection_pageInfo(ctx, field, obj)
+			if out.Values[i] == graphql.Null {
+				out.Invalids++
+			}
+		default:
+			panic("unknown field " + strconv.Quote(field.Name))
+		}
+	}
+	out.Dispatch(ctx)
+	if out.Invalids > 0 {
+		return graphql.Null
+	}
+
+	atomic.AddInt32(&ec.deferred, int32(len(deferred)))
+
+	for label, dfs := range deferred {
+		ec.processDeferredGroup(graphql.DeferredGroup{
+			Label:    label,
+			Path:     graphql.GetPath(ctx),
+			FieldSet: dfs,
+			Context:  ctx,
+		})
+	}
+
+	return out
+}
+
+var riskEdgeImplementors = []string{"RiskEdge"}
+
+func (ec *executionContext) _RiskEdge(ctx context.Context, sel ast.SelectionSet, obj *types.RiskEdge) graphql.Marshaler {
+	fields := graphql.CollectFields(ec.OperationContext, sel, riskEdgeImplementors)
+
+	out := graphql.NewFieldSet(fields)
+	deferred := make(map[string]*graphql.FieldSet)
+	for i, field := range fields {
+		switch field.Name {
+		case "__typename":
+			out.Values[i] = graphql.MarshalString("RiskEdge")
+		case "cursor":
+			out.Values[i] = ec._RiskEdge_cursor(ctx, field, obj)
+			if out.Values[i] == graphql.Null {
+				out.Invalids++
+			}
+		case "node":
+			out.Values[i] = ec._RiskEdge_node(ctx, field, obj)
+			if out.Values[i] == graphql.Null {
+				out.Invalids++
+			}
+		default:
+			panic("unknown field " + strconv.Quote(field.Name))
+		}
+	}
+	out.Dispatch(ctx)
+	if out.Invalids > 0 {
+		return graphql.Null
+	}
+
+	atomic.AddInt32(&ec.deferred, int32(len(deferred)))
+
+	for label, dfs := range deferred {
+		ec.processDeferredGroup(graphql.DeferredGroup{
+			Label:    label,
+			Path:     graphql.GetPath(ctx),
+			FieldSet: dfs,
+			Context:  ctx,
+		})
+	}
+
+	return out
+}
+
 var sessionImplementors = []string{"Session"}
 
 func (ec *executionContext) _Session(ctx context.Context, sel ast.SelectionSet, obj *types.Session) graphql.Marshaler {
@@ -21597,6 +23258,45 @@ func (ec *executionContext) _UpdatePolicyPayload(ctx context.Context, sel ast.Se
 	return out
 }
 
+var updateRiskPayloadImplementors = []string{"UpdateRiskPayload"}
+
+func (ec *executionContext) _UpdateRiskPayload(ctx context.Context, sel ast.SelectionSet, obj *types.UpdateRiskPayload) graphql.Marshaler {
+	fields := graphql.CollectFields(ec.OperationContext, sel, updateRiskPayloadImplementors)
+
+	out := graphql.NewFieldSet(fields)
+	deferred := make(map[string]*graphql.FieldSet)
+	for i, field := range fields {
+		switch field.Name {
+		case "__typename":
+			out.Values[i] = graphql.MarshalString("UpdateRiskPayload")
+		case "risk":
+			out.Values[i] = ec._UpdateRiskPayload_risk(ctx, field, obj)
+			if out.Values[i] == graphql.Null {
+				out.Invalids++
+			}
+		default:
+			panic("unknown field " + strconv.Quote(field.Name))
+		}
+	}
+	out.Dispatch(ctx)
+	if out.Invalids > 0 {
+		return graphql.Null
+	}
+
+	atomic.AddInt32(&ec.deferred, int32(len(deferred)))
+
+	for label, dfs := range deferred {
+		ec.processDeferredGroup(graphql.DeferredGroup{
+			Label:    label,
+			Path:     graphql.GetPath(ctx),
+			FieldSet: dfs,
+			Context:  ctx,
+		})
+	}
+
+	return out
+}
+
 var updateTaskPayloadImplementors = []string{"UpdateTaskPayload"}
 
 func (ec *executionContext) _UpdateTaskPayload(ctx context.Context, sel ast.SelectionSet, obj *types.UpdateTaskPayload) graphql.Marshaler {
@@ -22697,6 +24397,25 @@ func (ec *executionContext) marshalNCreatePolicyPayload2ᚖgithubᚗcomᚋgetpro
 	return ec._CreatePolicyPayload(ctx, sel, v)
 }
 
+func (ec *executionContext) unmarshalNCreateRiskInput2githubᚗcomᚋgetproboᚋproboᚋpkgᚋserverᚋapiᚋconsoleᚋv1ᚋtypesᚐCreateRiskInput(ctx context.Context, v any) (types.CreateRiskInput, error) {
+	res, err := ec.unmarshalInputCreateRiskInput(ctx, v)
+	return res, graphql.ErrorOnPath(ctx, err)
+}
+
+func (ec *executionContext) marshalNCreateRiskPayload2githubᚗcomᚋgetproboᚋproboᚋpkgᚋserverᚋapiᚋconsoleᚋv1ᚋtypesᚐCreateRiskPayload(ctx context.Context, sel ast.SelectionSet, v types.CreateRiskPayload) graphql.Marshaler {
+	return ec._CreateRiskPayload(ctx, sel, &v)
+}
+
+func (ec *executionContext) marshalNCreateRiskPayload2ᚖgithubᚗcomᚋgetproboᚋproboᚋpkgᚋserverᚋapiᚋconsoleᚋv1ᚋtypesᚐCreateRiskPayload(ctx context.Context, sel ast.SelectionSet, v *types.CreateRiskPayload) graphql.Marshaler {
+	if v == nil {
+		if !graphql.HasFieldError(ctx, graphql.GetFieldContext(ctx)) {
+			ec.Errorf(ctx, "the requested element is null which the schema does not allow")
+		}
+		return graphql.Null
+	}
+	return ec._CreateRiskPayload(ctx, sel, v)
+}
+
 func (ec *executionContext) unmarshalNCreateTaskInput2githubᚗcomᚋgetproboᚋproboᚋpkgᚋserverᚋapiᚋconsoleᚋv1ᚋtypesᚐCreateTaskInput(ctx context.Context, v any) (types.CreateTaskInput, error) {
 	res, err := ec.unmarshalInputCreateTaskInput(ctx, v)
 	return res, graphql.ErrorOnPath(ctx, err)
@@ -22860,6 +24579,25 @@ func (ec *executionContext) marshalNDeletePolicyPayload2ᚖgithubᚗcomᚋgetpro
 	return ec._DeletePolicyPayload(ctx, sel, v)
 }
 
+func (ec *executionContext) unmarshalNDeleteRiskInput2githubᚗcomᚋgetproboᚋproboᚋpkgᚋserverᚋapiᚋconsoleᚋv1ᚋtypesᚐDeleteRiskInput(ctx context.Context, v any) (types.DeleteRiskInput, error) {
+	res, err := ec.unmarshalInputDeleteRiskInput(ctx, v)
+	return res, graphql.ErrorOnPath(ctx, err)
+}
+
+func (ec *executionContext) marshalNDeleteRiskPayload2githubᚗcomᚋgetproboᚋproboᚋpkgᚋserverᚋapiᚋconsoleᚋv1ᚋtypesᚐDeleteRiskPayload(ctx context.Context, sel ast.SelectionSet, v types.DeleteRiskPayload) graphql.Marshaler {
+	return ec._DeleteRiskPayload(ctx, sel, &v)
+}
+
+func (ec *executionContext) marshalNDeleteRiskPayload2ᚖgithubᚗcomᚋgetproboᚋproboᚋpkgᚋserverᚋapiᚋconsoleᚋv1ᚋtypesᚐDeleteRiskPayload(ctx context.Context, sel ast.SelectionSet, v *types.DeleteRiskPayload) graphql.Marshaler {
+	if v == nil {
+		if !graphql.HasFieldError(ctx, graphql.GetFieldContext(ctx)) {
+			ec.Errorf(ctx, "the requested element is null which the schema does not allow")
+		}
+		return graphql.Null
+	}
+	return ec._DeleteRiskPayload(ctx, sel, v)
+}
+
 func (ec *executionContext) unmarshalNDeleteTaskInput2githubᚗcomᚋgetproboᚋproboᚋpkgᚋserverᚋapiᚋconsoleᚋv1ᚋtypesᚐDeleteTaskInput(ctx context.Context, v any) (types.DeleteTaskInput, error) {
 	res, err := ec.unmarshalInputDeleteTaskInput(ctx, v)
 	return res, graphql.ErrorOnPath(ctx, err)
@@ -23814,6 +25552,109 @@ func (ec *executionContext) marshalNRemoveUserPayload2ᚖgithubᚗcomᚋgetprobo
 	return ec._RemoveUserPayload(ctx, sel, v)
 }
 
+func (ec *executionContext) marshalNRisk2ᚖgithubᚗcomᚋgetproboᚋproboᚋpkgᚋserverᚋapiᚋconsoleᚋv1ᚋtypesᚐRisk(ctx context.Context, sel ast.SelectionSet, v *types.Risk) graphql.Marshaler {
+	if v == nil {
+		if !graphql.HasFieldError(ctx, graphql.GetFieldContext(ctx)) {
+			ec.Errorf(ctx, "the requested element is null which the schema does not allow")
+		}
+		return graphql.Null
+	}
+	return ec._Risk(ctx, sel, v)
+}
+
+func (ec *executionContext) marshalNRiskConnection2githubᚗcomᚋgetproboᚋproboᚋpkgᚋserverᚋapiᚋconsoleᚋv1ᚋtypesᚐRiskConnection(ctx context.Context, sel ast.SelectionSet, v types.RiskConnection) graphql.Marshaler {
+	return ec._RiskConnection(ctx, sel, &v)
+}
+
+func (ec *executionContext) marshalNRiskConnection2ᚖgithubᚗcomᚋgetproboᚋproboᚋpkgᚋserverᚋapiᚋconsoleᚋv1ᚋtypesᚐRiskConnection(ctx context.Context, sel ast.SelectionSet, v *types.RiskConnection) graphql.Marshaler {
+	if v == nil {
+		if !graphql.HasFieldError(ctx, graphql.GetFieldContext(ctx)) {
+			ec.Errorf(ctx, "the requested element is null which the schema does not allow")
+		}
+		return graphql.Null
+	}
+	return ec._RiskConnection(ctx, sel, v)
+}
+
+func (ec *executionContext) marshalNRiskEdge2ᚕᚖgithubᚗcomᚋgetproboᚋproboᚋpkgᚋserverᚋapiᚋconsoleᚋv1ᚋtypesᚐRiskEdgeᚄ(ctx context.Context, sel ast.SelectionSet, v []*types.RiskEdge) graphql.Marshaler {
+	ret := make(graphql.Array, len(v))
+	var wg sync.WaitGroup
+	isLen1 := len(v) == 1
+	if !isLen1 {
+		wg.Add(len(v))
+	}
+	for i := range v {
+		i := i
+		fc := &graphql.FieldContext{
+			Index:  &i,
+			Result: &v[i],
+		}
+		ctx := graphql.WithFieldContext(ctx, fc)
+		f := func(i int) {
+			defer func() {
+				if r := recover(); r != nil {
+					ec.Error(ctx, ec.Recover(ctx, r))
+					ret = nil
+				}
+			}()
+			if !isLen1 {
+				defer wg.Done()
+			}
+			ret[i] = ec.marshalNRiskEdge2ᚖgithubᚗcomᚋgetproboᚋproboᚋpkgᚋserverᚋapiᚋconsoleᚋv1ᚋtypesᚐRiskEdge(ctx, sel, v[i])
+		}
+		if isLen1 {
+			f(i)
+		} else {
+			go f(i)
+		}
+
+	}
+	wg.Wait()
+
+	for _, e := range ret {
+		if e == graphql.Null {
+			return graphql.Null
+		}
+	}
+
+	return ret
+}
+
+func (ec *executionContext) marshalNRiskEdge2ᚖgithubᚗcomᚋgetproboᚋproboᚋpkgᚋserverᚋapiᚋconsoleᚋv1ᚋtypesᚐRiskEdge(ctx context.Context, sel ast.SelectionSet, v *types.RiskEdge) graphql.Marshaler {
+	if v == nil {
+		if !graphql.HasFieldError(ctx, graphql.GetFieldContext(ctx)) {
+			ec.Errorf(ctx, "the requested element is null which the schema does not allow")
+		}
+		return graphql.Null
+	}
+	return ec._RiskEdge(ctx, sel, v)
+}
+
+func (ec *executionContext) unmarshalNRiskOrderField2githubᚗcomᚋgetproboᚋproboᚋpkgᚋcoredataᚐRiskOrderField(ctx context.Context, v any) (coredata.RiskOrderField, error) {
+	tmp, err := graphql.UnmarshalString(v)
+	res := unmarshalNRiskOrderField2githubᚗcomᚋgetproboᚋproboᚋpkgᚋcoredataᚐRiskOrderField[tmp]
+	return res, graphql.ErrorOnPath(ctx, err)
+}
+
+func (ec *executionContext) marshalNRiskOrderField2githubᚗcomᚋgetproboᚋproboᚋpkgᚋcoredataᚐRiskOrderField(ctx context.Context, sel ast.SelectionSet, v coredata.RiskOrderField) graphql.Marshaler {
+	res := graphql.MarshalString(marshalNRiskOrderField2githubᚗcomᚋgetproboᚋproboᚋpkgᚋcoredataᚐRiskOrderField[v])
+	if res == graphql.Null {
+		if !graphql.HasFieldError(ctx, graphql.GetFieldContext(ctx)) {
+			ec.Errorf(ctx, "the requested element is null which the schema does not allow")
+		}
+	}
+	return res
+}
+
+var (
+	unmarshalNRiskOrderField2githubᚗcomᚋgetproboᚋproboᚋpkgᚋcoredataᚐRiskOrderField = map[string]coredata.RiskOrderField{
+		"CREATED_AT": coredata.RiskOrderFieldCreatedAt,
+	}
+	marshalNRiskOrderField2githubᚗcomᚋgetproboᚋproboᚋpkgᚋcoredataᚐRiskOrderField = map[coredata.RiskOrderField]string{
+		coredata.RiskOrderFieldCreatedAt: "CREATED_AT",
+	}
+)
+
 func (ec *executionContext) unmarshalNRiskTier2githubᚗcomᚋgetproboᚋproboᚋpkgᚋcoredataᚐRiskTier(ctx context.Context, v any) (coredata.RiskTier, error) {
 	tmp, err := graphql.UnmarshalString(v)
 	res := unmarshalNRiskTier2githubᚗcomᚋgetproboᚋproboᚋpkgᚋcoredataᚐRiskTier[tmp]
@@ -24154,6 +25995,25 @@ func (ec *executionContext) marshalNUpdatePolicyPayload2ᚖgithubᚗcomᚋgetpro
 	return ec._UpdatePolicyPayload(ctx, sel, v)
 }
 
+func (ec *executionContext) unmarshalNUpdateRiskInput2githubᚗcomᚋgetproboᚋproboᚋpkgᚋserverᚋapiᚋconsoleᚋv1ᚋtypesᚐUpdateRiskInput(ctx context.Context, v any) (types.UpdateRiskInput, error) {
+	res, err := ec.unmarshalInputUpdateRiskInput(ctx, v)
+	return res, graphql.ErrorOnPath(ctx, err)
+}
+
+func (ec *executionContext) marshalNUpdateRiskPayload2githubᚗcomᚋgetproboᚋproboᚋpkgᚋserverᚋapiᚋconsoleᚋv1ᚋtypesᚐUpdateRiskPayload(ctx context.Context, sel ast.SelectionSet, v types.UpdateRiskPayload) graphql.Marshaler {
+	return ec._UpdateRiskPayload(ctx, sel, &v)
+}
+
+func (ec *executionContext) marshalNUpdateRiskPayload2ᚖgithubᚗcomᚋgetproboᚋproboᚋpkgᚋserverᚋapiᚋconsoleᚋv1ᚋtypesᚐUpdateRiskPayload(ctx context.Context, sel ast.SelectionSet, v *types.UpdateRiskPayload) graphql.Marshaler {
+	if v == nil {
+		if !graphql.HasFieldError(ctx, graphql.GetFieldContext(ctx)) {
+			ec.Errorf(ctx, "the requested element is null which the schema does not allow")
+		}
+		return graphql.Null
+	}
+	return ec._UpdateRiskPayload(ctx, sel, v)
+}
+
 func (ec *executionContext) unmarshalNUpdateTaskInput2githubᚗcomᚋgetproboᚋproboᚋpkgᚋserverᚋapiᚋconsoleᚋv1ᚋtypesᚐUpdateTaskInput(ctx context.Context, v any) (types.UpdateTaskInput, error) {
 	res, err := ec.unmarshalInputUpdateTaskInput(ctx, v)
 	return res, graphql.ErrorOnPath(ctx, err)
@@ -24979,6 +26839,14 @@ var (
 	}
 )
 
+func (ec *executionContext) unmarshalORiskOrder2ᚖgithubᚗcomᚋgetproboᚋproboᚋpkgᚋserverᚋapiᚋconsoleᚋv1ᚋtypesᚐRiskOrderBy(ctx context.Context, v any) (*types.RiskOrderBy, error) {
+	if v == nil {
+		return nil, nil
+	}
+	res, err := ec.unmarshalInputRiskOrder(ctx, v)
+	return &res, graphql.ErrorOnPath(ctx, err)
+}
+
 func (ec *executionContext) unmarshalORiskTier2ᚖgithubᚗcomᚋgetproboᚋproboᚋpkgᚋcoredataᚐRiskTier(ctx context.Context, v any) (*coredata.RiskTier, error) {
 	if v == nil {
 		return nil, nil
diff --git a/pkg/server/api/console/v1/types/risk.go b/pkg/server/api/console/v1/types/risk.go
new file mode 100644
index 000000000..9e9a2bf92
--- /dev/null
+++ b/pkg/server/api/console/v1/types/risk.go
@@ -0,0 +1,54 @@
+// Copyright (c) 2025 Probo Inc <hello@getprobo.com>.
+//
+// Permission to use, copy, modify, and/or distribute this software for any
+// purpose with or without fee is hereby granted, provided that the above
+// copyright notice and this permission notice appear in all copies.
+//
+// THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH
+// REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+// AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT,
+// INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+// LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR
+// OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+// PERFORMANCE OF THIS SOFTWARE.
+
+package types
+
+import (
+	"github.com/getprobo/probo/pkg/coredata"
+	"github.com/getprobo/probo/pkg/page"
+)
+
+type (
+	RiskOrderBy OrderBy[coredata.RiskOrderField]
+)
+
+func NewRiskConnection(p *page.Page[*coredata.Risk, coredata.RiskOrderField]) *RiskConnection {
+	var edges = make([]*RiskEdge, len(p.Data))
+
+	for i := range edges {
+		edges[i] = NewRiskEdge(p.Data[i], p.Cursor.OrderBy.Field)
+	}
+
+	return &RiskConnection{
+		Edges:    edges,
+		PageInfo: NewPageInfo(p),
+	}
+}
+
+func NewRiskEdge(r *coredata.Risk, orderBy coredata.RiskOrderField) *RiskEdge {
+	return &RiskEdge{
+		Cursor: r.CursorKey(orderBy),
+		Node:   NewRisk(r),
+	}
+}
+
+func NewRisk(r *coredata.Risk) *Risk {
+	return &Risk{
+		ID:          r.ID,
+		Name:        r.Name,
+		Description: r.Description,
+		CreatedAt:   r.CreatedAt,
+		UpdatedAt:   r.UpdatedAt,
+	}
+}
diff --git a/pkg/server/api/console/v1/types/types.go b/pkg/server/api/console/v1/types/types.go
index e663e54ee..dba69c4a3 100644
--- a/pkg/server/api/console/v1/types/types.go
+++ b/pkg/server/api/console/v1/types/types.go
@@ -113,6 +113,16 @@ type CreatePolicyPayload struct {
 	PolicyEdge *PolicyEdge `json:"policyEdge"`
 }
 
+type CreateRiskInput struct {
+	OrganizationID gid.GID `json:"organizationId"`
+	Name           string  `json:"name"`
+	Description    string  `json:"description"`
+}
+
+type CreateRiskPayload struct {
+	RiskEdge *RiskEdge `json:"riskEdge"`
+}
+
 type CreateTaskInput struct {
 	MitigationID gid.GID        `json:"mitigationId"`
 	Name         string         `json:"name"`
@@ -182,6 +192,14 @@ type DeletePolicyPayload struct {
 	DeletedPolicyID gid.GID `json:"deletedPolicyId"`
 }
 
+type DeleteRiskInput struct {
+	RiskID gid.GID `json:"riskId"`
+}
+
+type DeleteRiskPayload struct {
+	DeletedRiskID gid.GID `json:"deletedRiskId"`
+}
+
 type DeleteTaskInput struct {
 	TaskID gid.GID `json:"taskId"`
 }
@@ -313,6 +331,7 @@ type Organization struct {
 	Peoples     *PeopleConnection     `json:"peoples"`
 	Policies    *PolicyConnection     `json:"policies"`
 	Mitigations *MitigationConnection `json:"mitigations"`
+	Risks       *RiskConnection       `json:"risks"`
 	CreatedAt   time.Time             `json:"createdAt"`
 	UpdatedAt   time.Time             `json:"updatedAt"`
 }
@@ -401,6 +420,27 @@ type RemoveUserPayload struct {
 	Success bool `json:"success"`
 }
 
+type Risk struct {
+	ID          gid.GID   `json:"id"`
+	Name        string    `json:"name"`
+	Description string    `json:"description"`
+	CreatedAt   time.Time `json:"createdAt"`
+	UpdatedAt   time.Time `json:"updatedAt"`
+}
+
+func (Risk) IsNode()             {}
+func (this Risk) GetID() gid.GID { return this.ID }
+
+type RiskConnection struct {
+	Edges    []*RiskEdge `json:"edges"`
+	PageInfo *PageInfo   `json:"pageInfo"`
+}
+
+type RiskEdge struct {
+	Cursor page.CursorKey `json:"cursor"`
+	Node   *Risk          `json:"node"`
+}
+
 type Session struct {
 	ID        gid.GID   `json:"id"`
 	ExpiresAt time.Time `json:"expiresAt"`
@@ -497,6 +537,16 @@ type UpdatePolicyPayload struct {
 	Policy *Policy `json:"policy"`
 }
 
+type UpdateRiskInput struct {
+	ID          gid.GID `json:"id"`
+	Name        *string `json:"name,omitempty"`
+	Description *string `json:"description,omitempty"`
+}
+
+type UpdateRiskPayload struct {
+	Risk *Risk `json:"risk"`
+}
+
 type UpdateTaskInput struct {
 	TaskID       gid.GID             `json:"taskId"`
 	Name         *string             `json:"name,omitempty"`
diff --git a/pkg/server/api/console/v1/v1_resolver.go b/pkg/server/api/console/v1/v1_resolver.go
index 48ab02c81..dce73d983 100644
--- a/pkg/server/api/console/v1/v1_resolver.go
+++ b/pkg/server/api/console/v1/v1_resolver.go
@@ -457,7 +457,7 @@ func (r *mutationResolver) CreateTask(ctx context.Context, input types.CreateTas
 		TimeEstimate: input.TimeEstimate,
 	})
 	if err != nil {
-		return nil, fmt.Errorf("cannot create task: %w", err)
+		panic(fmt.Errorf("cannot create task: %w", err))
 	}
 
 	return &types.CreateTaskPayload{
@@ -477,7 +477,7 @@ func (r *mutationResolver) UpdateTask(ctx context.Context, input types.UpdateTas
 		TimeEstimate: input.TimeEstimate,
 	})
 	if err != nil {
-		return nil, fmt.Errorf("cannot update task: %w", err)
+		panic(fmt.Errorf("cannot update task: %w", err))
 	}
 
 	return &types.UpdateTaskPayload{
@@ -491,7 +491,7 @@ func (r *mutationResolver) DeleteTask(ctx context.Context, input types.DeleteTas
 
 	err := svc.Tasks.Delete(ctx, input.TaskID)
 	if err != nil {
-		return nil, fmt.Errorf("cannot delete task: %w", err)
+		panic(fmt.Errorf("cannot delete task: %w", err))
 	}
 
 	return &types.DeleteTaskPayload{
@@ -505,7 +505,7 @@ func (r *mutationResolver) AssignTask(ctx context.Context, input types.AssignTas
 
 	task, err := svc.Tasks.Assign(ctx, input.TaskID, input.AssignedToID)
 	if err != nil {
-		return nil, fmt.Errorf("cannot assign task: %w", err)
+		panic(fmt.Errorf("cannot assign task: %w", err))
 	}
 
 	return &types.AssignTaskPayload{
@@ -519,7 +519,7 @@ func (r *mutationResolver) UnassignTask(ctx context.Context, input types.Unassig
 
 	task, err := svc.Tasks.Unassign(ctx, input.TaskID)
 	if err != nil {
-		return nil, fmt.Errorf("cannot unassign task: %w", err)
+		panic(fmt.Errorf("cannot unassign task: %w", err))
 	}
 
 	return &types.UnassignTaskPayload{
@@ -527,6 +527,62 @@ func (r *mutationResolver) UnassignTask(ctx context.Context, input types.Unassig
 	}, nil
 }
 
+// CreateRisk is the resolver for the createRisk field.
+func (r *mutationResolver) CreateRisk(ctx context.Context, input types.CreateRiskInput) (*types.CreateRiskPayload, error) {
+	svc := r.GetTenantServiceIfAuthorized(ctx, input.OrganizationID.TenantID())
+
+	risk, err := svc.Risks.Create(
+		ctx,
+		probo.CreateRiskRequest{
+			OrganizationID: input.OrganizationID,
+			Name:           input.Name,
+			Description:    input.Description,
+		},
+	)
+	if err != nil {
+		panic(fmt.Errorf("cannot create risk: %w", err))
+	}
+
+	return &types.CreateRiskPayload{
+		RiskEdge: types.NewRiskEdge(risk, coredata.RiskOrderFieldCreatedAt),
+	}, nil
+}
+
+// UpdateRisk is the resolver for the updateRisk field.
+func (r *mutationResolver) UpdateRisk(ctx context.Context, input types.UpdateRiskInput) (*types.UpdateRiskPayload, error) {
+	svc := r.GetTenantServiceIfAuthorized(ctx, input.ID.TenantID())
+
+	risk, err := svc.Risks.Update(
+		ctx,
+		probo.UpdateRiskRequest{
+			ID:          input.ID,
+			Name:        input.Name,
+			Description: input.Description,
+		},
+	)
+	if err != nil {
+		panic(fmt.Errorf("cannot update risk: %w", err))
+	}
+
+	return &types.UpdateRiskPayload{
+		Risk: types.NewRisk(risk),
+	}, nil
+}
+
+// DeleteRisk is the resolver for the deleteRisk field.
+func (r *mutationResolver) DeleteRisk(ctx context.Context, input types.DeleteRiskInput) (*types.DeleteRiskPayload, error) {
+	svc := r.GetTenantServiceIfAuthorized(ctx, input.RiskID.TenantID())
+
+	err := svc.Risks.Delete(ctx, input.RiskID)
+	if err != nil {
+		panic(fmt.Errorf("cannot delete risk: %w", err))
+	}
+
+	return &types.DeleteRiskPayload{
+		DeletedRiskID: input.RiskID,
+	}, nil
+}
+
 // UploadEvidence is the resolver for the uploadEvidence field.
 func (r *mutationResolver) UploadEvidence(ctx context.Context, input types.UploadEvidenceInput) (*types.UploadEvidencePayload, error) {
 	svc := r.GetTenantServiceIfAuthorized(ctx, input.TaskID.TenantID())
@@ -790,6 +846,31 @@ func (r *organizationResolver) Mitigations(ctx context.Context, obj *types.Organ
 	return types.NewMitigationConnection(page), nil
 }
 
+// Risks is the resolver for the risks field.
+func (r *organizationResolver) Risks(ctx context.Context, obj *types.Organization, first *int, after *page.CursorKey, last *int, before *page.CursorKey, orderBy *types.RiskOrderBy) (*types.RiskConnection, error) {
+	svc := r.GetTenantServiceIfAuthorized(ctx, obj.ID.TenantID())
+
+	pageOrderBy := page.OrderBy[coredata.RiskOrderField]{
+		Field:     coredata.RiskOrderFieldCreatedAt,
+		Direction: page.OrderDirectionDesc,
+	}
+	if orderBy != nil {
+		pageOrderBy = page.OrderBy[coredata.RiskOrderField]{
+			Field:     orderBy.Field,
+			Direction: orderBy.Direction,
+		}
+	}
+
+	cursor := types.NewCursor(first, after, last, before, pageOrderBy)
+
+	page, err := svc.Risks.ListForOrganizationID(ctx, obj.ID, cursor)
+	if err != nil {
+		panic(fmt.Errorf("cannot list organization risks: %w", err))
+	}
+
+	return types.NewRiskConnection(page), nil
+}
+
 // Owner is the resolver for the owner field.
 func (r *policyResolver) Owner(ctx context.Context, obj *types.Policy) (*types.People, error) {
 	svc := r.GetTenantServiceIfAuthorized(ctx, obj.ID.TenantID())
@@ -875,6 +956,12 @@ func (r *queryResolver) Node(ctx context.Context, id gid.GID) (types.Node, error
 		}
 
 		return types.NewControl(control), nil
+	case coredata.RiskEntityType:
+		risk, err := svc.Risks.Get(ctx, id)
+		if err != nil {
+			return nil, err
+		}
+		return types.NewRisk(risk), nil
 	default:
 	}