Prismatic Perimeter Core

Overview

Prismatic Perimeter Core contains the business logic for External Attack Surface Management. It implements security rating algorithms, compliance assessment engines, and risk scoring models as pure computational modules, independent of any web interface or API layer. This separation enables the same scoring logic to serve the LiveView dashboard, the REST API, and CLI tooling without duplication.

The security rating engine evaluates entities across 12 security dimensions -- including TLS configuration, DNS security, email authentication, vulnerability exposure, and network hygiene -- to compute a composite grade from A (excellent) to F (critical risk) backed by a numeric score on a 300-900 scale. Each dimension produces an evidence-based sub-score with confidence weights aligned to the platform's NABLA epistemic framework, ensuring that ratings reflect verified observations rather than assumptions.

Compliance assessment engines implement full evaluation logic for the NIS2 Directive (EU 2022/2555) and ZKB 264/2025 Sb. (Czech Republic cybersecurity regulation). The framework is extensible, allowing new compliance standards to be added through configuration-driven rule definitions without code changes. This positions the platform to rapidly support emerging regulations across EU member states.

Architecture

Evidence Collection --> Evidence Store --> Rating Engine --> Grade + Score
        |                   |               |              |
  Scanner Results      Normalized       12 Dimension    A-F Grade
  OSINT Data           Evidence Sets    Sub-Scorers     300-900 Score
  Compliance Data      Confidence       Aggregation     Percentile
        |                                    |
  Compliance Engine <-- Rule Definitions --> Assessment Report
        |                                    |
  NIS2 Evaluator                        ZKB Evaluator

All computation follows functional programming principles with pure functions at the core. Side effects (database writes, event emission) occur only at the boundary layer, making the rating algorithms fully testable and deterministic.

Key Modules

Key Features

Security Rating Engine

The 12-dimension rating engine evaluates distinct security aspects with independent evidence sets and confidence weights:

defmodule PrismaticPerimeterCore.RatingEngine do
  @spec compute(EvidenceSet.t()) :: {:ok, Rating.t()} | {:error, term()}
  def compute(evidence_set) do
    dimensions = @dimensions
    |> Enum.map(fn dim ->
      evidence = EvidenceSet.for_dimension(evidence_set, dim.id)
      score = DimensionScorer.score(dim, evidence)
      confidence = DimensionScorer.confidence(dim, evidence)
      {dim, score, confidence}
    end)

    weighted_score = compute_weighted_score(dimensions)
    grade = GradeComputer.to_grade(weighted_score)
    overall_confidence = compute_overall_confidence(dimensions)

    {:ok, %Rating{
      grade: grade,
      score: weighted_score,
      dimensions: format_dimensions(dimensions),
      confidence: overall_confidence,
      evidence_count: EvidenceSet.count(evidence_set),
      computed_at: DateTime.utc_now()
    }}
  end

  defp compute_weighted_score(dimensions) do
    {total_score, total_weight} = Enum.reduce(dimensions, {0.0, 0.0}, fn
      {dim, score, confidence}, {sum, weight} when confidence > 0.3 ->
        adjusted = score * confidence
        {sum + adjusted * dim.weight, weight + dim.weight}
      _low_confidence, acc ->
        acc
    end)

    round(total_score / max(total_weight, 0.01) * 6 + 300)
  end
end

• Multi-factor scoring across 12 security dimensions with evidence weighting
• Grade computation (A-F) with numeric scores (300-900) for granular comparison
• Industry percentile benchmarking against peer entity populations
• Trend analysis and trajectory prediction for rating evolution

Grade Mapping

Compliance Engines

• NIS2 Directive (EU 2022/2555) full assessment with article-level mapping and gap identification
• ZKB 264/2025 Sb. (Czech Republic) compliance evaluation with section-level detail
• Extensible framework for custom compliance standards via configuration-driven rule definitions
• Evidence-based compliance scoring with gap identification and remediation recommendations

defmodule PrismaticPerimeterCore.Nis2Evaluator do
  @spec assess(map()) :: {:ok, Nis2Assessment.t()} | {:error, term()}
  def assess(entity_data) do
    articles = @nis2_articles
    |> Enum.map(fn article ->
      evidence = extract_evidence(entity_data, article.requirements)
      status = evaluate_compliance(evidence, article.criteria)
      {article, status, evidence}
    end)

    overall = compute_overall_compliance(articles)

    {:ok, %Nis2Assessment{
      compliant: overall.score >= @compliance_threshold,
      score: overall.score,
      gaps: identify_gaps(articles),
      articles: format_article_results(articles),
      recommendations: generate_recommendations(articles),
      assessed_at: DateTime.utc_now()
    }}
  end
end

Risk Models

• Evidence-weighted risk aggregation across all intelligence sources
• Temporal risk trajectory analysis with configurable time windows
• Confidence-adjusted risk scores integrated with NABLA axioms
• Multi-source evidence fusion with contradiction detection

Usage

# Compute security rating from evidence
{:ok, rating} = PrismaticPerimeterCore.compute_rating(evidence_set)
# => %{grade: :B, score: 780, factors: [...], confidence: 0.92}

# NIS2 compliance assessment
{:ok, assessment} = PrismaticPerimeterCore.assess_nis2(entity_data)
# => %{compliant: false, gaps: [article_21: :partial], score: 0.74}

# ZKB compliance check
{:ok, zkb} = PrismaticPerimeterCore.assess_zkb(entity_data)
# => %{compliant: true, score: 0.91, gaps: []}

# Risk trajectory over time
{:ok, trajectory} = PrismaticPerimeterCore.risk_trajectory(
  entity: "example.com", window: :last_90_days
)
# => %{trend: :improving, current: 0.23, predicted_30d: 0.19}

# Per-dimension scoring breakdown
{:ok, breakdown} = PrismaticPerimeterCore.dimension_scores(evidence_set)
# => %{tls: 92, dns: 78, email: 65, vulnerability: 88, ...}

NABLA Compliance

Testing

Rating engine tests verify scoring algorithm correctness, grade boundary accuracy, and weighted aggregation stability against known evidence sets. Compliance engine tests verify NIS2 article-level evaluation accuracy and ZKB section-level assessment against labeled compliance scenarios. Risk trajectory tests verify trend computation and prediction accuracy.

Dimension scorer tests verify per-dimension evidence evaluation and confidence computation with edge cases (missing evidence, contradictory observations, single-source data). Property-based tests generate random evidence sets to verify rating monotonicity invariants -- adding positive evidence should never decrease ratings.

Integration Points

Performance

Telemetry events: [:prismatic, :perimeter_core, :rating_computed], [:prismatic, :perimeter_core, :compliance_assessed], [:prismatic, :perimeter_core, :dimension_scored].

Related Resources

• Prismatic Detection Engine -- Detection findings influence security rating adjustments
• CER Compliance Commander -- Drives NIS2 and ZKB compliance assessment logic and regulatory control mapping
• Competitor Researcher -- Provides industry benchmarking intelligence for peer comparison in security rating percentiles
• Adapter Pattern Specialist -- Designs the extensible compliance engine framework enabling new standards through configuration
• NABLA Axioms -- Confidence-adjusted risk scores and evidence-weighted ratings grounded in epistemic axioms
• Intelligence Synthesis -- Multi-source evidence fusion across 12 security dimensions with contradiction detection
• Quality Gates -- Scoring algorithm invariant verification ensuring grades remain monotonically ordered and bounded

Connect & Contribute

Created by Tomáš Korcak (korczis) | Open Source under GHL

• GitHub | GitLab | LinkedIn | Contact
• Developer Portal | Architecture | Meet the Creator