Tool silos
Every scanner speaks a different schema, making cross-tool prioritization slow and inconsistent.
SIH 2026 · PS 26105 · AICTE Cyber Security Cell
Find the risk.
Price the loss.
Fund the right fix.
RiskForge AI converts fragmented security findings into explainable business risk, probable financial exposure, and an optimized security investment plan—so a CISO can decide what to fix first and show why.
8 toolsnormalizer coverage across code, web, network, containers and dependencies
6 factorsdeterministic, explainable cyber-risk model
5,000+Monte Carlo trials for portfolio tail-risk views
₹ → actionexpected loss, scenario testing and budget optimization
01 — The current problem
Security teams count vulnerabilities. Boards must choose investments.
Most security workflows end at a severity label: 37 critical, 142 high, hundreds more waiting. That describes technical urgency, but not the asset at stake, likely disruption, regulatory exposure, or the best use of a limited budget.
The operational gap: annual or periodic assessments become stale while vulnerabilities, exploitation activity, assets and controls change continuously. Teams either patch the loudest item, try to patch everything, or defend decisions with a heat map that has no financial denominator.
“Design and develop an AI-powered platform that continuously quantifies cyber risk in monetary terms by correlating technical security telemetry with business asset criticality and control effectiveness, then recommends cost-effective mitigation under explicit budget constraints.”
Severity ≠ business risk
A lower-CVSS issue on a revenue-critical public asset can outrank a severe lab finding.
False precision
Loss is a distribution, not one guaranteed number. Tail outcomes matter to reserves and governance.
Finite budget
A list of recommendations does not prove which combination produces the most risk reduction.
02 — Global scale & India context
The risk is global, measurable—and increasingly tied to business interruption.
These datasets use different populations and methods; they are evidence of scale, not values to be added together. RiskForge uses the same discipline internally: observed facts, assumptions, calculations and AI narrative stay distinguishable.
IBM’s 2025 study reported a 9% year-over-year decline, while showing that faster identification and containment changes the financial outcome.
IBM, 2025 ↗Verizon’s 2025 DBIR analyzed 12,195 confirmed breaches; ransomware presence rose 37% from the prior report.
Verizon DBIR, 2025 ↗The DBIR figure doubled year over year, making vendor and dependency exposure a board-level risk variable.
Verizon infographic ↗The FBI received 1,008,597 complaints in 2025—reported losses were 26% higher than 2024.
FBI IC3, 2025 ↗India recorded ₹22,495 crore in cyber-fraud losses and 28.15 lakh complaints in 2025; 76% of reported financial loss was attributed to fake investment and trading scams.SOURCE · PRESS INFORMATION BUREAU · 21 AUGUST 2026 ↗
Context note: FBI and India figures are complaint-based and reflect reported losses; IBM is a sampled organizational cost study; Verizon is a contributed incident/breach dataset. They answer different questions.
03 — Product objective & boundaries
Turn telemetry into a defensible funding decision.
RiskForge accelerates analysts and decision-makers; it does not replace scanners, finance owners, control owners, auditors, or accountable executive judgement.
✓
Normalize heterogeneous findings into one canonical, scanner-independent record.
✓
Enrich findings with asset criticality, exposure, business dependency and threat activity.
✓
Calculate an explainable risk score, annual probability and INR expected loss.
✓
Model uncertainty with P50, VaR 95%, CVaR 95%, VaR 99% and a loss distribution.
✓
Simulate controls before purchase and compare baseline versus residual exposure.
✓
Optimize a control portfolio under a budget and expose assumptions and provenance.
CURRENTLY IMPLEMENTED
- Adapters/normalizers for Semgrep, ZAP, Nmap, Trivy, Gitleaks, OSV, Nuclei and OpenVAS
- Asset and business-context profiles, including annual revenue and revenue dependency
- NVD, CISA KEV and MITRE ATT&CK enrichment with local caching
- Deterministic six-factor risk scoring and INR financial loss modelling
- Monte Carlo simulation, control what-if analysis, compliance mapping and OR-Tools optimization
- FastAPI APIs, PostgreSQL/SQLite path, Celery/Redis jobs and React/Vite dashboard
NOT A CLAIM OF CURRENT CAPABILITY
- A replacement for source scanners, EDR, SIEM, CSPM or human incident response
- A guarantee that an incident will occur—or that a modelled loss will be realized
- Fully automatic remediation or purchasing without owner approval
- Perfect causal modelling between correlated findings and chained attack paths
- Production live-CLI execution for every integrated scanner
- Regulatory, legal, actuarial or audit conclusions without professional review
04 — The current implemented flow
Context first. Evidence next. Decisions last.
This sequence reflects the implemented backend and UI contract. The asset’s business context must be saved before scoring; otherwise technical findings cannot be translated into meaningful rupee exposure.
01
Register the asset
Business input: environment, criticality, internet exposure, data sensitivity, annual revenue, revenue dependency and existing controls.
02
Ingest scanner evidence
Observed: upload supported JSON results or queue a path-based job. Semgrep can run against a directory; other live CLI paths remain JSON-ingest-first.
03
Normalize
Canonical schema: each adapter converts tool-specific fields into title, evidence, severity, CVE/CWE, location, source and asset linkage.
04
Enrich
Threat context: NVD data, CISA Known Exploited Vulnerabilities and MITRE mappings add exploitability and threat activity without changing source evidence.
05
Score risk
Calculated: a versioned six-factor weighted model produces a 0–10 score and LOW / MEDIUM / HIGH / CRITICAL classification. No LLM performs this calculation.
06
Price exposure
Financial model: annual incident probability × potential impact. Revenue interruption, response, recovery, customer and once-per-asset regulatory exposure remain inspectable.
07
Simulate uncertainty
Monte Carlo: PERT/triangular impact assumptions across 5,000+ portfolio trials produce expected loss, median, VaR and CVaR. Findings are currently treated as independent.
08
Map governance
Compliance: findings and controls map to ISO/IEC 27001, NIST CSF, CIS Controls, RBI and SEBI views for evidence-led reporting.
09
Explain & recommend
AI-generated: the provider-independent LLM layer turns calculated results into executive narrative and mitigation rationale; it may explain numbers but cannot override them.
10
Test controls
Scenario: the what-if engine applies control effects and recalculates before/after risk and expected loss, preserving the baseline for comparison.
11
Optimize the budget
Optimized: Google OR-Tools selects the control combination that maximizes modeled risk reduction within budget; a dynamic-programming fallback preserves the workflow.
12
Review the decision
Human action: the CISO dashboard presents top contributors, financial tail risk, recommended controls, ROSI and investment curve for approval—not automatic purchase.
[OBSERVED]scanner evidence, ports, CVEs, CVSS and asset facts
[CALCULATED]scores, probabilities, EAL, VaR, CVaR and deltas
[AI-GENERATED]summaries, explanations and recommendation rationale
[OPTIMIZED]selected control portfolio and budget allocation
05 — System architecture
Layered so every number can be traced back to evidence.
Scanner-specific logic stops at normalization. The risk engine only consumes canonical findings, which keeps new integrations modular and prevents a tool’s schema from leaking into business calculations.
01 / Experience
Executive dashboardEAL, VaR, risk trend and top contributors
Risk workspaceAsset and finding drill-down
Scenario labControl toggles and before/after views
AI advisorNatural-language, board-ready explanation
02 / API & jobs
FastAPIAssets, scans, findings and risk routes
Decision APIsSimulation, budgets and recommendations
Celery + RedisQueued ingest and AI explanation jobs
Auth & settingsJWT, providers and configurable assumptions
03 / Evidence
Scanner adaptersTool execution or report ingestion
NormalizersOne canonical finding contract
Threat intelligenceNVD, CISA KEV and MITRE ATT&CK
Compliance mapISO, NIST, CIS, RBI and SEBI
04 / Quantification
Risk engineDeterministic six-factor score
Loss modelProbability × decomposed impact
Monte CarloPERT/triangular loss distribution
Portfolio metricsOperational + once-per-asset regulatory EL
05 / Decision
Control libraryCost, scope and effectiveness
What-if engineResidual-risk scenario calculation
OR-Tools0/1 knapsack budget optimization
LLM providerExplain only; never calculate
06 / Persistence
PostgreSQL / SQLiteAssets, findings, scans and decisions
Intel cacheResilient external-context retrieval
Model versionsRisk and simulation traceability
Audit provenanceSource and transformation labels
06 — Quantitative & AI intelligence
Two kinds of intelligence. One hard boundary.
Quantitative engines decide the numbers; generative AI explains them. That separation is RiskForge’s central trust control.
Deterministic risk engine
Weights technical severity, asset criticality, exposure, exploitability, threat activity and business impact. Existing controls reduce relevant dimensions before the final score is stored.
Risk = .20T + .20A + .15E + .15X + .15H + .15B
Probabilistic loss engine
Maps score to conservative annual probability, boosts known exploitation, decomposes impact and samples uncertain outcomes. Portfolio EL remains analytically consistent; VaR/CVaR come from simulation.
P = 1 / (1 + e^(-0.8(score - 7.8)))
EAL = P(incident) × impact
EAL = P(incident) × impact
Constrained AI advisor
Uses the platform’s factual inputs and calculated outputs to write explanations and proposed actions. Provider adapters support multiple LLMs, but none may create CVSS, EAL, VaR or optimizer selections.
Evidence + calculations → narrative
Narrative ≠ calculation authority
Narrative ≠ calculation authority
20%technical severity
20%asset criticality
15%exposure
15%exploitability
15%threat activity
15%business impact
07 — One finding, followed end to end
A technical alert becomes an investment decision.
The visual below shows the product’s mental model. It is not a promise of exact loss; every monetary output depends on recorded business assumptions and versioned model logic.
08 — Related news / business impact
MARKS & SPENCER · APRIL 2025£300mESTIMATED FY 2025/26 OPERATING-PROFIT IMPACT BEFORE MITIGATION
A cyber incident moved from the security queue to the income statement.
M&S said it paused orders through UK & Ireland websites and apps while managing the incident. In its full-year results, the retailer estimated an approximately £300 million impact on group operating profit before mitigation, with management actions, insurance and cost control expected to reduce the final effect.
Cyber incident→Online orders paused→Trading disruption→Profit impact→Mitigation + insurance
M&S full-year results, 21 May 2025 ↗
Why this maps to RiskForge
A severity score alone cannot express paused digital sales, disruption duration, response cost, insurance offsets or dependency on one service. RiskForge’s asset context and loss decomposition are designed to put those variables beside the technical finding before controls compete for budget.
09 — Previous incidents & recurring loss patterns
The bill rarely stops at incident response.
Past cases show why cyber exposure must combine customer harm, disruption, recovery, legal/regulatory cost and the business criticality of the affected service.
147 million people; up to $700m settlement
The FTC said Equifax agreed to pay at least $575 million and potentially up to $700 million to settle allegations that it failed to take reasonable steps to secure its network.
FTC case record ↗Approximately $100m quarterly impact
MGM estimated a roughly $100 million negative impact to Adjusted Property EBITDAR from the September cybersecurity incident, turning operational downtime into a disclosed financial event.
SEC Form 8-K ↗$2.2bn response + $867m disruption
UnitedHealth reported direct response costs and Optum Insight business disruption, plus more than $9 billion in provider funding support—evidence of systemic third-party and service-dependency risk.
UnitedHealth 2024 Form 10-K ↗Incident scopes and accounting treatments differ. Values are shown as reported by the linked primary source, not normalized or summed.
10 — What the decision-maker receives
Not another vulnerability list. A decision package.
Every view should make the next question easier: what drives the risk, how uncertain is it, which control changes it, and what fits the approved budget?
01
Risk register
Normalized findings ranked with asset, threat, business and compliance context—not CVSS alone.
02
Financial exposure
Operational and regulatory expected loss, P50, VaR 95%, CVaR 95%, VaR 99% and distribution.
03
Scenario comparison
Baseline versus residual risk after selected controls, with visible assumptions and deltas.
04
Investment plan
Optimized control set, total cost, remaining budget, risk reduction, scoped loss reduction and ROSI.
11 — Project modules & deliverables
A complete prototype from evidence intake to executive review.
01
Asset & business contextCriticality, exposure, data, revenue and controls
02
Scanner ingestion layerEight tool-specific adapters and normalizers
03
Threat intelligence layerNVD, CISA KEV and MITRE ATT&CK context
04
Quantitative risk engineVersioned, deterministic and configurable
05
Financial + Monte Carlo engineEAL, percentiles, VaR and CVaR in INR
06
Compliance mappingISO 27001, NIST CSF, CIS, RBI and SEBI
07
AI advisorProvider-independent explanations and rationale
08
What-if simulatorControl-effect scenarios and residual risk
09
Budget optimizerOR-Tools knapsack, fallback, ROSI and curve
10
CISO dashboardReact workspaces backed by live FastAPI routes
12 — Stack, implementation status & limits
Built as an inspectable decision system.
FRONTENDReact 18 · TypeScript · Vite · Recharts · Lucide
BACKENDPython 3.11+ · FastAPI · Pydantic · SQLAlchemy
DATAPostgreSQL 16 · SQLite dev path · cached threat intel
JOBSCelery · Redis · platform-aware worker configuration
SECURITY TOOLSSemgrep · ZAP · Nmap · Trivy · Gitleaks · OSV · Nuclei · OpenVAS
QUANTITATIVENumPy · PERT/triangular simulation · CVSS v3.1
OPTIMIZATIONGoogle OR-Tools · 0/1 knapsack · DP fallback
DELIVERYDocker Compose · REST API · configurable LLM providers
Current known limits
- Monte Carlo currently treats finding-level incidents as independent; correlated attack paths need explicit modelling.
- A configurable ₹50 crore annual-revenue proxy is used when organization finance data is absent.
- Live directory execution is implemented for Semgrep; other scanner paths primarily ingest JSON reports.
- External enrichment depends on upstream access and cache freshness.
- The backend APIs are complete, while parts of the frontend remain work in progress.
Recommended next validation
- Back-test probability calibration and financial assumptions against incident and insurance data.
- Model shared-cause and attack-chain correlation across related findings.
- Version every assumption, intelligence lookup and control effect in an audit event.
- Benchmark optimizer recommendations with CISO/control-owner review and sensitivity analysis.
- Complete end-to-end UI, role-based approvals and reproducible report export.
13 — Research & implementation sources
Evidence behind the story.
External figures link to research, regulators or primary company filings. Product details describe the current implemented prototype and its stated limitations.
01
Cost of a Data Breach Report 2025Global average breach cost and security-governance findings.
IBM ↗02
2025 Data Breach Investigations ReportGlobal breach sample, ransomware, vulnerability exploitation and third-party involvement.
Verizon ↗03
2025 Internet Crime ReportComplaint volume, reported losses and scam/cybercrime categories.
FBI IC3 ↗04
Cyber Suraksha Abhiyan briefingIndia’s 2025 cyber-fraud complaints, losses and investment/trading-scam share.
PIB ↗05
M&S FY2024/25 resultsCyber incident response, online-order pause and estimated operating-profit impact.
M&S ↗08
UnitedHealth Group 2024 Form 10-KChange Healthcare response costs, disruption and provider support.
SEC ↗