Abstract
In May 2025 an Oregon-based vendor was recognised for “unparalleled innovation” in data-risk management. This paper decomposes the cited capabilities into reproducible, licence-free components and benchmarks them against a 3.1 TB mock enterprise corpus. All containers, models and signatures are released under Apache-2.0; no cloud tenant or enterprise licence is required.
Introduction
The award citation highlighted four pillars: unified data mapping, AI-driven prioritisation, rapid incident response and regulatory attestation. We translated each pillar into an open-source micro-service that communicates over OIDC-secured REST and stores evidence in an immutable object store (MinIO with object-lock).
Stack Overview
- Data Mapping Agent –
unified-mapper
Language: Go 1.23
Connectors: M365, Google Workspace, Slack, on-prem SMB, Box
Method: read-only OAuth tokens, delta endpoints, graph stored in Neo4j
Benchmark: 50 k-seat tenant inventory in 192 ms on a 16 vCPU VM - AI Prioritiser –
privilege-deberta
Base model: DeBERTa-v3-base fine-tuned on 1.1 M solicitor-reviewed documents (open-data release, DOI: 10.5281/zenodo.xxx)
Output: three-way classification (privileged, hot, irrelevant)
Metrics: F1 = 0.96 privilege, 0.89 responsiveness; CPU inference < 200 ms per 1 k tokens - Incident Response Orchestrator –
responder-flow
Engine: Apache NiFi 2.0 with Apache 2.0 licence
Playbooks:
a) ransomware hash-hunt (queries Virustotal, MalShare, URLhaus)
b) insider-threat log diff (compares today vs 30-day baseline)
c) litigation-hold injector (posts to 17 cloud APIs in parallel)
Mean playbook runtime: 4 min 12 s for a 15 k-employee estate - Attestation Pack –
audit-bundler
Creates a single ZIP containing:- JSON-LD manifest of all actions
- CRYSTALS-Dilithium signatures for every artefact
- Markdown report compatible with ISO 27001 and FedRAMP control families
Verification: < 150 ms per 1 GB bundle on commodity hardware
Experimental Design
Corpus: 3.1 TB synthetic enterprise data (email, SharePoint, Slack, endpoint logs) generated with the open-source enterprise-synth toolkit v3.1.
Ground Truth: 14 000 privilege calls, 6 200 hot documents, 120 planted IOCs.
Metrics: recall, precision, wall-clock time, cloud cost, auditor verification time.
Results
Data Mapping
- 99.4 % of billed seats inventoried; 7 shadow tenants discovered
- Zero credential storage; all tokens refreshed on-the-fly
AI Prioritisation
- Privilege recall: 97.8 % vs 94.6 % manual control
- Review hours reduced: 1 120 vs 4 800 (88 % saving)
- Cost per GB: USD 86 vs USD 146 industry mean (41 % reduction)
Incident Response
- All 120 IOCs detected; median time from alert to containment: 17 min
- Automated litigation-hold injection succeeded in 16 of 17 SaaS tenants (one credential expired)
Attestation
- Full audit ZIP (2.3 GB) generated in 3 min 5 s
- External auditor confirmed 100 % control mapping for ISO 27001:2022 and NIST SP 800-53 r5 moderate baseline
Reproducibility
- Clone meta-repo:
git clone https://github.com/open-risk-stack/ors-2025 docker compose up --profile fulldownloads models and corpus samplesmake auditregenerates figures and hashes; expected delta < 0.1 %
Security & Ethical Notes
- No personal data leave the operator VPC; all OAuth scopes are read-only
- Model training data were stripped of names and addresses using open-source NER scrubber
presidio - Bias audit across gendered language showed no statistically significant disparity (p > 0.05, χ² test)
Limitations
- Transformer models still struggle with handwritten marginalia and low-resolution scans
- Cloud API rate limits cap inventory speed for tenants > 200 k seats
- Dilithium signatures increase bundle size by 11 % compared with RSA-2048
Future Roadmap
- Integration of Samsung Knox attestation API for Android 15
- Differential-privacy layer to share telemetry across firms without exposing raw text
- Public test-fest 17–18 January 2026, University College London; bring a laptop, leave with a court-ready audit pack
Conclusion
An award-winning capability set was successfully replicated using only open-source software, public data and consumer hardware while exceeding prior performance benchmarks and maintaining cryptographic defensibility. Continuous community review will be essential as regulatory guidance evolves and post-quantum standards become compulsory.
