Aforethought, the risk system. It runs the discipline a medical-device company runs on whatever you're about to build, names what has to change, and gives you the verdict before you build it, not after.
One real thing you're building. One week. A verdict, not a demo.
Already running this file by hand, in a spreadsheet that lets a severity drop with nobody's name on it? Read what we refuse to do →
You have a design you like and a date you already promised. Somebody just told you it's regulated. Now there's a consultant quote you can't justify, or a spreadsheet someone started that nobody trusts, and the real fear underneath both of them is the same: finding out after you've built it that you have to build it again.
That's the fear this answers. Aforethought runs the sweep before the design is committed, not after the prototype ships. You get a verdict on the thing you're building this week, scored against the criteria a medical-device manufacturer used on its own products. The rebuild is the thing we're here to prevent, and prevention only works if it happens first.
Sweep. Verdict. Register. Gate.
One lens of analysis, run over one subject. Six lenses: preliminary, system, component, interaction, use, process. The sweep supplies the interrogation. Your team supplies the thinking. Aforethought doesn't invent your hazards; it makes sure none of them get skipped.
Every row lands as Unacceptable, ALARP, or Acceptable, with the numbered cell, the basis, and the action it compels. ALARP is the middle band: tolerable only after every practical control is in place, and only once someone has written down whether and how the risk that remains gets disclosed. It's the most useful idea in the whole system, and we don't flatten it into a pass/fail to make the page simpler.
The file itself. Every row, score, control, status, decision, and signature, traceable end to end and stamped with the criteria version it was scored under. It's built to outlive the project: three years from now, someone should still be able to answer which version scored row 44.
The moment the register is asked whether the work may proceed. A gate passes, or it names its blockers. We will not hand you the sentence "all risks have been considered" when they haven't.
This is where the refusals live, and they're the point:
If you've watched a severity get quietly softened so a control looked adequate, or you've been unable to say which version of the criteria scored an old row, you already know why those three lines matter more than anything else on this page.
The receipt
The engine was rebuilt from a real medical-device manufacturer's risk acceptance criteria, and re-scored 504 recorded verdicts from a completed hazard analysis in that company's own risk file. 494 reproduced: 472 matched cell for cell, and 22 matched the verdict and the band with only the cell index inside the lowest band differing. Zero disagreed. 10 records were unusable: 7 carried inputs the engine couldn't score, and 3 were unreadable in the source.
The engine that did it is a pair of lookup tables and a set of band boundaries. It holds no medical content at all. It never chose a severity either. The people who wrote that file chose the severities and the probabilities, and the engine turned them into the same verdicts they had recorded.
That's the whole argument. The judgment stays with the people who have it, and the instrument that grades it doesn't care what industry you're in.
The historical file exercises 6 of the 20 severity-probability combinations the criteria define. The other 14 are verified against the criteria document itself, not against historical verdicts, because the file never visited them.
One engine, industry packs
The product is the engine and the method: the scoring engine, the six analysis lenses, the control-effectiveness precedence, the three acceptance levels, the register, the gate, the report. It's the same whatever industry you're in.
An industry pack supplies the severity ranks and their anchors, the consequence classes, the codes, the population bands, the escalation roles, and the regulatory bindings. That's the only thing that changes.
Aforethought, Medical Device Edition is pack one. It's the flagship proof, and it's the pack we're selling from today.
Your industry becomes a pack. That's a conversation, and today it starts with a sweep run under the medical-device pack's criteria on your subject.
What you're using instead
| What you're using | What it actually gives you | What Aforethought gives you instead |
|---|---|---|
| Spreadsheets | What it actually gives youA memory aid two people fill in differently. In the file we re-scored, two vocabularies were live one row apart and the column headers disagreed with the data underneath them, which swaps severity and probability silently and throws no error. | What Aforethought gives you insteadA closed-list function that rejects what it can't score. A lowered severity with no written rationale doesn't stand, a control with no traceable requirement doesn't stand, and every row is stamped with the criteria version it was scored under. |
| Consultants | What it actually gives youReal judgment, arriving after the design is already committed, filed into a binder that ages into fiction. | What Aforethought gives you insteadThe judgment is resident and always on. It arrives before the design is committed, and it stays in a file you can trace end to end. |
| GRC suites | What it actually gives youA place to store risk after the fact. Sold to compliance, priced on audit readiness. | What Aforethought gives you insteadRuns upstream, at the moment the work is proposed, and it can say no. It names the blockers and withholds the release sentence while a gate is violated. |
| Doing nothing | What it actually gives youThe rework. The field action. The launch that slips. | What Aforethought gives you insteadA sweep against a rebuild. |
What it costs
The first sweep is one real thing you're building, scored end to end, delivered as an artifact you can forward.
—After the first sweep, the engagement is where this is meant to go: your subject stays under continuous sweep as the design changes, your register stays live, and every gate you run is on the record.
—If your team already runs its own risk file and wants the engine and the register without the sweep service, that's available directly.
—No tier chart, no seat count games. You're buying a verdict, then you're buying the discipline that keeps producing one. Stephen can walk you through which one fits what you're building.
For the person who already runs this file
You don't need the category explained. You've watched two analysts score the same hazard two different ways. You've watched a residual severity get quietly lowered so a control looked adequate. You cannot say, for a row scored three years ago, which version of the criteria it was scored under, and you already know the day that question is going to arrive.
Aforethought doesn't sell you faster. It sells you refusal. Here's exactly what it refuses to do, and what we refuse to do with it:
That's the whole pitch, in three refusals. If it matches what you've never said out loud in a vendor meeting, forward this page. It was written for you to forward.
Book a sweep
We run a sweep on it and hand you the verdicts. That's the whole ask.