Security, access & compliance
Control coverage, identity chains, data sovereignty and software supply chain exposure.
13 of 388 tools.
Audit cyber control evidence integrity
Audit whether claimed defense in depth is supported by current independent control tests mapped to declared attack-path steps, while preserving duplicate mappings and counting each exposed business asset only once.
Audit data sovereignty residency evidence integrity
Audit every governed data asset's point-in-time storage, processing, replica, backup, log/cache and key locations plus cross-region transfers against an effective counsel-supplied residency policy, independent evidence, encryption controls and retention limits.
Audit software supply chain integrity
Audit the deployed runtime software supply chain from application roots through resolved dependency edges: reconcile SBOM freshness, version resolution, source pinning, artifact attestation, support horizon, license policy, vulnerability disposition, evidence coverage and unique application value without treating repository text as provenance or exploitability evidence.
Audit workforce identity access evidence integrity
Audit the point-in-time chain from an opaque workforce subject through authorized accounts, independent identity evidence, approved least-privilege grants and MFA/device-backed access events.
Bayesian account risk triage
Prioritize human review of auditable account-security and policy-conflict evidence using Bayes factors and decision costs.
Forecast cross border data restriction loss
Forecast migration, operating, contract and common jurisdiction loss from counsel-defined cross-border data restrictions with a Gamma-Poisson event model, pooled log-normal duration/cost and coherent tail scenarios.
Forecast cyber control failure loss
Forecast expected and tail cyber loss with locally pooled threat frequency, control reliability and lognormal loss severity, drawing one shared control state across every path it protects to preserve common-mode failure.
Forecast privileged identity exposure loss
Forecast aggregate privileged-identity compromise frequency and financial tail loss with separate Gamma-Poisson security states, locally pooled log-normal severity and one coherently simulated common identity-provider event.
Forecast software supply chain loss
Forecast aggregate software supply-chain loss with tenant-calibrated empirical-Bayes Gamma-Poisson incident frequencies, partially pooled lognormal loss marks, common frequency/severity/business scenarios, and multiplicative unique-application disruption paths; unsupported risk classes make the output diagnostic-only.
Optimize cyber control portfolio
Find a budget-, capacity-, availability- and defense-depth-feasible cyber-control portfolio on a nonlinear attack-path graph, recomputing unique-asset expected loss and CVaR under dependencies, exclusions and multiplicative effects.
Optimize identity assurance response portfolio
Choose one preauthorized identity-assurance response per aggregate account-risk case by maximizing simulated net access value minus security, false-positive, operating and CVaR costs under budget, capacity, control, availability and due-process constraints.
Optimize software supply chain remediation portfolio
Choose exactly one accept, patch, upgrade, replace, isolate or remove option per governed component while unique application disruption paths, direct incident loss, transition/operating/upfront cost, license compliance, scenario availability, cross-option feasibility, budget, capacity and CVaR are optimized together with exact or disclosed beam search.
Optimize sovereign data placement portfolio
Choose one executable regional placement per governed data workload by Monte Carlo posterior risk and exact/beam Pareto search under hard residency, KMS, encryption, diversity, latency, availability, relation, budget and capacity constraints.