---
title: 13.05 Known Limitations
description: SimpleRisk does many things well; some it doesn't do at all. This reference catalogs the known limitations operators should know about — no native…
---
[Skip to content](https://support.simplerisk.com/kb/13-05-known-limitations#main-content)
English
Show submenu for translations
[Customer portal](https://support.simplerisk.com/tickets?hsLang=en)
[](https://www.simplerisk.com/)
Open main navigation
Close main navigation
- English
Show submenu for translations
- [Customer portal](https://support.simplerisk.com/tickets)
- [Contact us](https://www.simplerisk.com/about-us/contact-us)
[Contact us](https://www.simplerisk.com/about-us/contact-us)
How can we help you?
- There are no suggestions because the search field is empty.
1. [SimpleRisk Knowledge Base](https://support.simplerisk.com/kb?hsLang=en)
2. [Administrator Guide](https://support.simplerisk.com/kb/administrator-guide?hsLang=en)
3. [13 Reference](https://support.simplerisk.com/kb/administrator-guide?hsLang=en#13-reference)
# 13.05 Known Limitations
## SimpleRisk does many things well; some it doesn't do at all. This reference catalogs the known limitations operators should know about — no native outbound webhooks, no API rate limiting, no native key rotation for the Encryption Extra, no per-user notification opt-out, etc. Use this to set expectations and plan workarounds; many limitations are addressable via Extras or external tooling.
## Why this is a reference article
This article catalogs the substantive limitations operators encounter in SimpleRisk. The list is honest — these are real gaps, not features that exist with limitations. Knowing the gaps before they surprise you allows planning around them; missing the gaps in design produces "we assumed SimpleRisk did X" disappointments.
Each limitation includes the workaround that programs typically use. Most limitations are addressable; the workarounds vary in cost.
## Authentication and identity
### No native OIDC
SimpleRisk supports SAML 2.0 and LDAP for SSO; it doesn't have a native OIDC client. **Workaround**: use the IdP's SAML endpoint (every major OIDC provider also speaks SAML), or front OIDC with a SAML-capable broker. See [Configuring OIDC](https://support.simplerisk.com/kb/04-05-oidc-setup?hsLang=en).
### No SCIM provisioning
SimpleRisk doesn't accept SCIM-style bulk provisioning. **Workaround**: use the v2 user-management API for bulk provisioning; or rely on just-in-time provisioning during SSO login.
### No WebAuthn / FIDO2 hardware-token MFA
Core MFA is TOTP-only. **Workaround**: enforce MFA at the IdP layer (SAML / LDAP) where WebAuthn is supported; SimpleRisk inherits the IdP's MFA posture for SSO users.
### No SMS-based MFA
Intentionally — NIST SP 800-63B has deprecated SMS as a second factor. TOTP via authenticator app is the supported alternative.
### No built-in MFA recovery codes
If a user loses their TOTP device, recovery requires admin intervention (clear their MFA secret; re-enroll). **Workaround**: documented operator procedure; identity-verify before clearing.
## API
### No native rate limiting
SimpleRisk's v2 API has no built-in rate limiting or per-key quotas. **Workaround**: enforce at a reverse proxy (nginx, HAProxy) or CDN (Cloudflare, AWS WAF) in front of SimpleRisk. See [Rate Limiting and Quotas](https://support.simplerisk.com/kb/08-04-rate-limiting-and-quotas?hsLang=en).
### No native pagination on list endpoints
Most list endpoints return all matching records in one response. **Workaround**: filter at the source via query parameters; cache locally; use per-record endpoints when you know the ID.
### No outbound webhooks
SimpleRisk doesn't POST to external URLs on its events. The only inbound webhook is from Jira (via the Jira Extra). **Workaround**: poll the API on schedule; use a workflow automation platform; build custom dispatch via the Workflows Extra. See [Webhook Integration](https://support.simplerisk.com/kb/07-03-webhook-integration?hsLang=en).
## Email and notifications
### No per-user notification opt-out
Users can't unsubscribe from specific notification types via a UI; the per-event toggles are system-wide. **Workaround**: tune the notification configuration to balance signal vs noise for the entire user base; for users who genuinely shouldn't receive notifications, change their account configuration or role.
### No HTML/text dual-format emails
Emails go out in one format. **Workaround**: design templates that render reasonably in both modes (most modern email clients handle HTML email fine).
## Reporting
### No native scheduled reports
SimpleRisk Core has no built-in "send this report every Monday" feature. **Workaround**: cron-driven script + email; or BI tool integration; or workflow automation platform. See [Scheduled Reports](https://support.simplerisk.com/kb/11-04-scheduled-reports?hsLang=en).
### Limited one-click export
Most reports don't have one-click export. The Dynamic Risk Report does (an Excel spreadsheet of exactly what's on screen), but only when the Import-Export Extra is active. **Workaround**: API-driven extraction.
### No native PDF export for most reports
Some reports support PDF export via the application's print path; many don't. **Workaround**: browser-side print-to-PDF; or scripted extraction with custom PDF generation.
### No public-link sharing for reports
Reports are accessible only to authenticated users. **Workaround**: extract and email; or use the API to feed external dashboards.
## Customization
### Custom fields only on risks
The Customization Extra adds custom fields to risk-related forms (details, mitigation, review). Other entities (assets, controls, frameworks, documents) don't support custom fields. **Workaround**: encode the data in existing fields where possible; or layer additional Extras that add domain-specific custom fields.
### Form layout customization is limited
Custom field placement, hiding standard fields, reordering — these work via the Customization Extra. Deeper UI customization (theme changes, custom widgets, custom navigation) requires code changes. **Workaround**: file feature requests for specific needs.
### No native white-labeling
The SimpleRisk branding is in the application. **Workaround**: code-level customization (with care to preserve upgrade compatibility).
## Workflows and automation
### No state-machine enforcement
Workflows trigger on events; they don't gate state transitions. A risk doesn't get blocked from moving to a different state because a workflow hasn't completed. **Workaround**: operational discipline; workflow actions that update state; custom approval flows via the Workflows Extra.
### Workflows are events + actions, not full programming
The action catalog covers communication (email, Slack, webhook). Complex business logic requires dispatch via webhook to external scripts. **Workaround**: thin SimpleRisk-side workflow that fires a webhook to your custom logic.
## Encryption
### Single per-install master key
The Encryption Extra has one key. No per-user keys, no per-record keys, no key escrow. **Workaround**: the operational discipline of off-server backup of the key file is non-negotiable.
### No native key rotation
Rotating the master key requires deactivate-and-reactivate (decrypt everything, then encrypt again with a new key). Expensive. **Workaround**: rotate only on suspected compromise.
### Selective encryption (~30 fields)
Not every field is encrypted. Lookup IDs, configuration settings, numeric scores remain plaintext. **Workaround**: this is by design (performance, queryability); the substantively-sensitive content is encrypted.
### Lose the key, lose the data
No recovery service. **Workaround**: rigorous off-server key backup.
## Database
### No native horizontal sharding
A single SimpleRisk install uses a single database. **Workaround**: multiple SimpleRisk installs (one per major segment); or vertical scaling.
### No native multi-tenancy
A SimpleRisk install is a single tenant. **Workaround**: multiple installs per tenant; or organize-via-team-segregation within one install (with careful access controls).
### Audit log grows without bound by default
The audit log accumulates entries forever. **Workaround**: define and enforce retention policy.
## UI and UX
### Global search needs the Advanced Search Extra
Core searches one list at a time: each table has its own search box and filters. Searching risks, frameworks, controls, documents, exceptions, tests, audits, assets, asset groups, incidents, assessments and vulnerabilities from one box comes with the **Advanced Search Extra**. With it active, the topbar search finds every type a user is allowed to open, and a full **Search** page works through the results type by type. Incidents, assessments and vulnerabilities appear only while their own Extras are active (vulnerabilities also need a configured scanner). Without the Advanced Search Extra, the topbar shows a **Search your whole program** box with a **Locked** badge, and clicking it explains what the Extra adds. The Search page doesn't have per-type filters yet (risk level, control family and the like). **Workaround**: without the Extra, use the search and filters on each list; with it, open a result's list when you need those filters.
One version mismatch to watch for. If you update the Advanced Search Extra before you upgrade SimpleRisk itself, a user whose only search permission is for incidents (**Allow Access to Incident Management "Incidents" Menu**), assessments (**Allow Access to "Assessments" Menu**) or vulnerabilities (**Allow Access to Vulnerability Management "Vulnerabilities" Menu**) gets results in the topbar search, but the older Search page turns them away. **Workaround**: upgrade SimpleRisk to the same release as the Extra; users who also hold a risk, governance, compliance or asset permission aren't affected.
### No native dark mode / theme toggle
The UI has one appearance. **Workaround**: browser-level dark-mode reader extensions for users who want them.
### Limited dashboard customization
Dashboards exist as fixed layouts with configurable widgets; deeper layout customization (custom widgets, beyond-grid layouts) isn't available. **Workaround**: external BI tooling.
### No native mobile app
SimpleRisk renders responsively on mobile browsers; there's no dedicated iOS/Android app. **Workaround**: use the web UI on mobile; or build a custom app on top of the API.
## Integration
### No deep two-way ServiceNow / SOAR integration
Beyond Jira (via the Jira Extra), SimpleRisk doesn't ship native integrations with ServiceNow, Splunk SOAR, Palo Alto XSOAR, etc. **Workaround**: build custom integrations against the v2 API.
### No native CMDB integration
Asset inventory in SimpleRisk is independent of any external CMDB. **Workaround**: API-driven sync from the CMDB to SimpleRisk.
### Limited threat-feed integration
SimpleRisk doesn't natively consume threat feeds (MISP, OpenCTI, commercial feeds). **Workaround**: external script that pulls from the feed and creates risks via the API.
## Operational
### No native multi-region deployment support
A SimpleRisk install runs in one region. Multi-region deployments need either a master-region install (with users in other regions accepting latency) or per-region installs (with no built-in cross-install correlation). **Workaround**: pick a primary region; CDN for static assets to reduce per-region latency.
### No native zero-downtime upgrade
Upgrades require application unavailability during the schema migration. **Workaround**: schedule maintenance windows; for very high uptime requirements, a complex blue-green pattern is achievable but not natively supported.
### No native A/B testing or staged rollout
Configuration changes apply to the whole install at once. **Workaround**: test in non-production first; coordinate production changes with users.
## Compliance and audit
### Limited compliance evidence packaging
Producing audit-ready evidence packages requires extraction work; SimpleRisk doesn't have a "click here for SOC 2 evidence package" button. **Workaround**: scripted extraction. See [Compliance Evidence Export](https://support.simplerisk.com/kb/11-03-compliance-evidence-export?hsLang=en).
### No native risk acceptance workflow with deep approval gating
The standard workflow uses the mitigation-acceptance pattern; programs needing complex multi-stage approval implement via the Workflows Extra plus operational discipline. **Workaround**: workflows; documented procedures.
## Acknowledgment
This list isn't exhaustive — every program encounters specific edge cases. The honest catalog above covers the most-impactful limitations operators commonly run into. For limitations not listed here, the SimpleRisk community forum and support channel can confirm whether something is a real limitation, an undocumented feature, or a configuration issue.
For limitations that block your program, file feature requests via [Getting Help](https://support.simplerisk.com/kb/00-02-getting-help?hsLang=en). The product evolves; many of today's limitations are tomorrow's features.
## Related
- [Settings Reference](https://support.simplerisk.com/kb/13-01-config-settings-reference?hsLang=en)
- [Database Schema Overview](https://support.simplerisk.com/kb/13-02-database-schema-overview?hsLang=en)
- [Cron Jobs Reference](https://support.simplerisk.com/kb/13-03-cron-jobs-reference?hsLang=en)
- [Default Roles and Permissions](https://support.simplerisk.com/kb/13-04-default-roles-and-permissions?hsLang=en)
- [Getting Help](https://support.simplerisk.com/kb/00-02-getting-help?hsLang=en)
- [When to Contact Support](https://support.simplerisk.com/kb/12-05-when-to-contact-support?hsLang=en)
- [FAQs](https://support.simplerisk.com/kb/faqs?hsLang=en)
- [SimpleRisk Extras](https://support.simplerisk.com/kb/simplerisk-extras?hsLang=en#main-content)
- [Vulnerability Management Extra](https://support.simplerisk.com/kb/simplerisk-extras?hsLang=en#vulnerability-management-extra)
- [Team Separation Extra](https://support.simplerisk.com/kb/simplerisk-extras?hsLang=en#team-separation-extra)
- [Import-Export Extra](https://support.simplerisk.com/kb/simplerisk-extras?hsLang=en#import-export-extra)
- [Administrator Guide](https://support.simplerisk.com/kb/administrator-guide?hsLang=en#main-content)
- [00 About This Guide](https://support.simplerisk.com/kb/administrator-guide?hsLang=en#00-about-this-guide)
- [01 Installation and Deployment](https://support.simplerisk.com/kb/administrator-guide?hsLang=en#01-installation-and-deployment)
- [02 Upgrades and Maintenance](https://support.simplerisk.com/kb/administrator-guide?hsLang=en#02-upgrades-and-maintenance)
- [03 Users and Permissions](https://support.simplerisk.com/kb/administrator-guide?hsLang=en#03-users-and-permissions)
- [04 Authentication](https://support.simplerisk.com/kb/administrator-guide?hsLang=en#04-authentication)
- [05 Customization](https://support.simplerisk.com/kb/administrator-guide?hsLang=en#05-customization)
- [06 Configuring Risk and Compliance](https://support.simplerisk.com/kb/administrator-guide?hsLang=en#06-configuring-risk-and-compliance)
- [07 Integrations](https://support.simplerisk.com/kb/administrator-guide?hsLang=en#07-integrations)
- [08 The API](https://support.simplerisk.com/kb/administrator-guide?hsLang=en#08-the-api)
- [09 Encryption and Data Security](https://support.simplerisk.com/kb/administrator-guide?hsLang=en#09-encryption-and-data-security)
- [10 Workflows and Automation](https://support.simplerisk.com/kb/administrator-guide?hsLang=en#10-workflows-and-automation)
- [11 Reporting and Auditing](https://support.simplerisk.com/kb/administrator-guide?hsLang=en#11-reporting-and-auditing)
- [12 Operations](https://support.simplerisk.com/kb/administrator-guide?hsLang=en#12-operations)
- [13 Reference](https://support.simplerisk.com/kb/administrator-guide?hsLang=en#13-reference)
- [User Guide](https://support.simplerisk.com/kb/user-guide?hsLang=en#main-content)
- [00 Foundations of GRC](https://support.simplerisk.com/kb/user-guide?hsLang=en#00-foundations-of-grc)
- [01 Risk Management](https://support.simplerisk.com/kb/user-guide?hsLang=en#01-risk-management)
- [02 Compliance Management](https://support.simplerisk.com/kb/user-guide?hsLang=en#02-compliance-management)
- [03 Governance](https://support.simplerisk.com/kb/user-guide?hsLang=en#03-governance)
- [04 Asset and Data Inventory](https://support.simplerisk.com/kb/user-guide?hsLang=en#04-asset-and-data-inventory)
- [05 Threat and Vulnerability Management](https://support.simplerisk.com/kb/user-guide?hsLang=en#05-threat-and-vulnerability-management)
- [06 Assessments](https://support.simplerisk.com/kb/user-guide?hsLang=en#06-assessments)
- [07 Incident Management](https://support.simplerisk.com/kb/user-guide?hsLang=en#07-incident-management)
- [08 Audit and Reporting](https://support.simplerisk.com/kb/user-guide?hsLang=en#08-audit-and-reporting)
- [09 Day-to-Day SimpleRisk](https://support.simplerisk.com/kb/user-guide?hsLang=en#09-day-to-day-simplerisk)
- [10 Continuous Improvement](https://support.simplerisk.com/kb/user-guide?hsLang=en#10-continuous-improvement)
- [SimpleRisk User Guides](https://support.simplerisk.com/kb/simplerisk-user-guides?hsLang=en)
- [Troubleshooting](https://support.simplerisk.com/kb/troubleshooting?hsLang=en)
- [SimpleRisk Hosted](https://support.simplerisk.com/kb/simplerisk-hosted?hsLang=en)
- [How To videos](https://support.simplerisk.com/kb/how-to-videos?hsLang=en)
[](https://www.simplerisk.com)
Copyright © 2026, SimpleRisk, Inc.