Forecast privileged identity exposure loss
Forecast aggregate privileged-identity compromise frequency and financial tail loss with separate Gamma-Poisson security states, locally pooled log-normal severity and one coherently simulated common identity-provider event.
What it's for
Quantifies the financial and tail consequence of privileged identity exposure, including shared identity-provider concentration, without turning security telemetry into named-person accusation.
What you give it
Inputs split into evidence read from your connected systems, calibration your team owns, and numerical controls that affect precision but never the result's meaning.
| Field | Type | Role | Required |
|---|---|---|---|
| current_identity_exposures | array of objects (15 fields) | Evidence | Yes |
| historical_identity_classes | array of objects (11 fields) | Evidence | Yes |
| identity_provider_groups | array of objects (3 fields) | Evidence | Yes |
| max_detail_rows | integer ≥ 1, ≤ 500 | Numerical control | Optional |
| minimum_history_periods | integer ≥ 1, ≤ 10000 | Your calibration | Optional |
| minimum_loss_observations | integer ≥ 1, ≤ 100000 | Your calibration | Optional |
| random_seed | integer ≥ 0, ≤ 4294967295 | Your calibration | Optional |
| scenarios | array of objects (8 fields) | Evidence | Yes |
| simulation_count | integer ≥ 1000, ≤ 200000 | Your calibration | Optional |
| tail_probability | number > 0, < 1 | Your calibration | Optional |
Each current_identity_exposures
record
| Field | Type | Required |
|---|---|---|
| elevated_rate_prior_rate | number (> 0) | Yes |
| elevated_rate_prior_shape | number (> 0) | Yes |
| elevated_signal_exposure_fraction | number (≥ 0, ≤ 1) | Yes |
| evidence_verified | boolean | Yes |
| forecast_exposure_account_days | number (≥ 0) | Yes |
| id | string (non-empty) | Yes |
| identity_class | string (non-empty) | Yes |
| identity_provider_group_id | string (non-empty) | Yes |
| loss_prior_log_mean | number | Yes |
| loss_prior_log_sd | number (> 0, ≤ 5) | Yes |
| loss_prior_strength | number (> 0) | Yes |
| normal_rate_prior_rate | number (> 0) | Yes |
| normal_rate_prior_shape | number (> 0) | Yes |
| preventive_control_effectiveness | number (≥ 0, ≤ 1) | Yes |
| privileged_account_count | integer (≥ 1) | Yes |
{
"current_identity_exposures": [
{
"elevated_rate_prior_rate": 100,
"elevated_rate_prior_shape": 1,
"elevated_signal_exposure_fraction": 0.1,
"evidence_verified": true,
"forecast_exposure_account_days": 1000,
"id": "privileged-humans",
"identity_class": "admin",
"identity_provider_group_id": "idp-core",
"loss_prior_log_mean": 10.819778284410283,
"loss_prior_log_sd": 0.5,
"loss_prior_strength": 5,
"normal_rate_prior_rate": 1000,
"normal_rate_prior_shape": 1,
"preventive_control_effectiveness": 0.5,
"privileged_account_count": 10
}
],
"historical_identity_classes": [
{
"elevated_exposure_account_days": 100,
"elevated_verified_compromise_count": 1,
"evidence_verified": true,
"id": "admin-history-0",
"identity_class": "admin",
"loss_log_squared_sum": 117.06760212379633,
"loss_log_sum": 10.819778284410283,
"loss_observation_count": 1,
"normal_exposure_account_days": 1000,
"normal_verified_compromise_count": 0,
"period": 0
}
],
"identity_provider_groups": [
{
"evidence_verified": true,
"id": "idp-core",
"unique_common_loss_scenarios": [
500000,
1000000
]
}Truncated for display — the full payload is 72 lines.
What you get back
This is the actual output of running the example above — computed by the same function the platform calls, not an illustration.
{
"assumptions": [
"History is consecutive and zero-inclusive; verified compromise and positive loss maturity are stable by aggregate identity class, and elevated-signal exposure is an auditable security state rather than a protected-trait or behavior proxy.",
"Scenario draws and one common provider event are shared coherently; individual severity uses a moment-matched sum of locally pooled log-normal losses and common provider value is counted once."
],
"counts": {
"current_exposures": 1,
"history_periods": 1,
"identity_classes": 1,
"provider_groups": 1,
"scenarios": 2,
"simulations": 1000
},
"decision": "review_privileged_identity_exposure_and_tail_loss",
"exposure_forecasts": [
{
"expected_individual_loss": 73638.527,
"expected_verified_compromises": 0.911,
"exposure_id": "privileged-humans",
"history_periods": 1,
"identity_class": "admin",
"identity_provider_group_id": "idp-core",
"probability_at_least_one_compromise": 0.532,
"support_gate_pass": true
}
],
"limitations": [
"This is an aggregate account-exposure forecast, not a prediction that a named person is malicious, concurrently employed, foreign, compromised or unsuitable for access or employment.",
"Unreported incidents, changing detection, nonstationary attackers, insurance/recovery, unmodeled dependencies and losses outside the submitted perimeter can make the tail incomplete."
],
"method": "gamma_poisson_compound_lognormal_common_idp_loss_forecast_v1",
"portfolio_forecast": {
"expected_common_provider_loss": 38500,
"expected_financial_loss": 112138.527,
"expected_verified_compromises": 1.011,
"financial_loss_conditional_value_at_risk": 1167650.6665,
"financial_loss_value_at_risk": 430042.3041,
"probability_any_verified_compromise": 0.532,
"tail_probability": 0.05
},
"reproducibility": {
"random_seed": 41,
"scenario_ids": [
"base",Truncated for display — the full payload is 50 lines.
How it works
Forecasting & survival — Estimate when something completes or fails, with censoring and unresolved work handled honestly rather than dropped.
- 1 Fit normal and elevated verified-compromise rates by stable aggregate identity class from consecutive, zero-inclusive account-day histories using explicit Gamma priors.
- 2 Pool mature positive-loss log moments with local prior strength, simulate compound individual losses, and share the same scenario draw across rates, severity and current exposures.
- 3 Simulate one common provider event per provider group, count its loss once, and report expected frequency, VaR/CVaR and support abstention diagnostics.
Before you trust it
Every tool in the catalog ships with the conditions under which its answer is meaningful — and the conditions under which it should abstain instead of guessing.
Assumptions & guardrails
- Training examples precede their outcomes, censoring and unresolved work are represented, and deployment populations remain comparable to validation cohorts.
- Detection and loss maturity are stable enough within each aggregate class; current exposure days and elevated-security state are measurable without protected-trait or individual-behavior proxies.
- A predictive interval or risk estimate is not a deadline promise, causal explanation, or individual-performance judgment.
- This forecasts portfolio account exposure, not whether any named person is malicious, foreign, compromised, concurrently employed or unsuitable for access or employment.
Minimum evidence
- historical_identity_classes: required and organization-defined
- current_identity_exposures: required and organization-defined
- identity_provider_groups: required and organization-defined
- scenarios: required and organization-defined
How to validate it
Use chronological train/calibration/test windows, compare proper scores and decision value with a simple baseline, and recalibrate only from outcomes resolved after prediction time.
Calibrating it to your org
Same for everyone
The mathematical kernel, validation rules, method version, and JSON output semantics are organization-independent; no tenant-trained coefficients or company benchmark is embedded in the function.
Specific to you
- calendar/class exposure spine left-joined to all verified compromise and mature loss events, including zero-event periods, then joined to current privileged-account inventory and one canonical identity-provider concentration group
- aggregate identity-class/state definitions, exposure clock, verified compromise and maturity rules, loss perimeter, prior provenance/strength, preventive-control effect, forecast horizon, common-event uniqueness, scenarios and tail appetite
Calibration workflow
- 1 Define the management decision, target outcome, aggregate unit, privacy boundary, cadence, and prediction/intervention horizon for this organization.
- 2 Build a tenant-scoped historical cohort using only information available before each prediction or decision; preserve zero periods, censoring, assignment probabilities, and unresolved outcomes when the method requires them.
- 3 Estimate statistical parameters on training history, but obtain costs, utilities, risk tolerance, practical-effect thresholds, capacity, and policy constraints from accountable decision owners.
- 4 Validate on later time windows or held-out aggregate units at the deployment grain, against a simple baseline and the function-specific validation strategy.
- 5 Deploy only if the returned decision clears evidence, overlap, calibration, robustness, and guardrail checks; warning, unsupported, schema-gap, and fallback decisions are abstentions.
- 6 Monitor realized outcomes, data drift, coverage, and decision regret; recalibrate at a governed cadence or after a detected regime/definition change, never merely because a stakeholder dislikes the result.
Call it from your AI
You don't wire up 388 tools in your MCP client. The GitRevio MCP server exposes 18 tools, three of which let an agent search the catalog, read a tool's schema, and run it — so the assistant finds this one on its own.
gitrevio_capabilities_search
{ "q": "forecast aggregate privilegedidentity compromise frequency and" }
→ finds "forecast_privileged_identity_exposure_loss"
gitrevio_capability_describe
{ "capability_id": "forecast_privileged_identity_exposure_loss" }
→ returns the input schema and agent guidance shown on this page
gitrevio_capability_run
{ "capability_id": "forecast_privileged_identity_exposure_loss", "arguments": { ... } }
→ returns the result shown aboveWorks in Claude Desktop, Claude Code, Cursor, Cline, Continue.dev, Goose and Aider. See the MCP server.
Related tools
Audit workforce identity access evidence integrity
Audit the point-in-time chain from an opaque workforce subject through authorized accounts, independent identity evidence, approved least-privilege grants and MFA/device-backed access events.
Optimize identity assurance response portfolio
Choose one preauthorized identity-assurance response per aggregate account-risk case by maximizing simulated net access value minus security, false-positive, operating and CVaR costs under budget, capacity, control, availability and due-process constraints.
Audit cyber control evidence integrity
Audit whether claimed defense in depth is supported by current independent control tests mapped to declared attack-path steps, while preserving duplicate mappings and counting each exposed business asset only once.
Audit data sovereignty residency evidence integrity
Audit every governed data asset's point-in-time storage, processing, replica, backup, log/cache and key locations plus cross-region transfers against an effective counsel-supplied residency policy, independent evidence, encryption controls and retention limits.
Audit software supply chain integrity
Audit the deployed runtime software supply chain from application roots through resolved dependency edges: reconcile SBOM freshness, version resolution, source pinning, artifact attestation, support horizon, license policy, vulnerability disposition, evidence coverage and unique application value without treating repository text as provenance or exploitability evidence.
Bayesian account risk triage
Prioritize human review of auditable account-security and policy-conflict evidence using Bayes factors and decision costs.