Continuous control monitoring for FedRAMP 20x. Pins FedRAMP's machine-readable rules, reconciles populations, gates IaC, emits schema-valid 20x artifacts.

One control inventory for a DoD CUI boundary. Five NDAA-driven regimes attach as crosswalk edges. Emits OSCAL O1-O5 and derives the SPRS score from assertion records.

AI governance control plane: a control is satisfied only when an executed adversarial attack failed.

Layered application flaw scanner that proves the bug it finds. A finding is verified-exploitable only once a generated attack changed another user's data.

Work an incident through an SEC Item 1.05 materiality determination: quantitative screen, SAB 99 total mix, four-business-day clock, contemporaneous memo.

Source-backed starting ranges for cyber loss estimates. Twelve shards, 72 parameters, every number citing a public study.

Sixteen OWASP Risk Rating factors with likelihood and impact kept separate. Severity read from the OWASP matrix with the active cell shown live.

AI risk register that returns loss exposure ranges instead of heat-map colours. Twelve seeded scenarios through a 10,000-iteration Monte Carlo.

Interactive loss exceedance curve. Overlay risk tolerance, loss reserves, and materiality to read the odds of crossing each one.

Interactive FAIR taxonomy trainer: walk the tree, rebuild it from memory, match 22 definitions. Placement and unit accuracy scored separately.

Watch the law of large numbers converge on a fair coin, then ask a loss model the same question. Ten flips land anywhere; ten thousand settle down.

Place risks on a 5x5 heat map, give each a frequency and loss range, then run 10,000 Monte Carlo iterations and watch the matrix become a distribution.

Engineering write-up of replacing invented numbers with sourced ones across the risk-lab tools, and of how little published loss data actually covers.