Prismatic Perimeter

Abstract

Prismatic Perimeter is an External Attack Surface Management (EASM) platform that discovers, inventories, and continuously monitors an organization's internet-facing assets to compute evidence-based security ratings on a 300-900 numeric scale with A-F letter grades. The system integrates data from over 121 OSINT intelligence sources, applies multi-factor scoring algorithms grounded in the NABLA epistemic framework, and assesses compliance against the NIS2 Directive (EU 2022/2555) and Czech ZKB (264/2025 Sb.) regulatory frameworks. Positioned competitively against BitSight, Black Kite, and SecurityScorecard, Prismatic Perimeter delivers its assessments through a real-time Phoenix LiveView dashboard, a RESTful API, and structured compliance reports. The architecture follows a three-layer separation of concerns -- core business logic, web presentation, and intelligence collection -- enabling independent scaling and testing of each layer.

1. Introduction

1.1 Problem Statement

Organizations face an expanding and increasingly opaque external attack surface. Cloud migrations, shadow IT, SaaS sprawl, certificate proliferation, and acquisitions introduce internet-facing assets that security teams cannot enumerate manually. Traditional vulnerability management operates from the inside out; EASM inverts this perspective, assessing an organization as an attacker would see it from the outside. Without continuous external monitoring, organizations discover exposures only after exploitation, compliance audits, or third-party breach notifications -- all of which carry significant operational and reputational cost.

The European regulatory landscape compounds this challenge. The NIS2 Directive imposes cybersecurity risk management obligations on essential and important entities across 18 sectors, while the Czech ZKB (264/2025 Sb.) transposes NIS2 into national law with additional Czech-specific requirements including NUKIB registration and Czech-language documentation. Organizations need automated tooling that maps external exposure directly to regulatory control requirements.

1.2 Design Goals

1. Comprehensive asset discovery -- enumerate all internet-facing assets (domains, subdomains, IPs, certificates, cloud resources, services) using passive and active reconnaissance.
2. Evidence-based security ratings -- compute scores from verifiable evidence rather than heuristic guesses, with full provenance tracing through NABLA axioms.
3. Regulatory compliance mapping -- automatically assess NIS2 and ZKB compliance from external evidence, generating audit-ready reports.
4. Real-time monitoring -- detect changes to the attack surface within hours through continuous OSINT source polling and change detection.
5. Industry benchmarking -- provide percentile rankings against industry peers for meaningful comparative assessment.
6. Separation of concerns -- isolate scoring algorithms, web presentation, and data collection into independently deployable OTP applications.

1.3 Scope

Prismatic Perimeter covers external attack surface assessment only. Internal vulnerability scanning, endpoint detection and response, and internal network monitoring are explicitly out of scope. The system assesses organizations from an external vantage point using publicly available data and authorized active scanning.

2. Architecture

2.1 System Design

The Perimeter subsystem is decomposed into three OTP applications within the Prismatic umbrella:

                         +---------------------------+
                         |   Prismatic Perimeter     |
                         |   (Facade / Orchestrator) |
                         +---------------------------+
                                |          |
                   +------------+          +------------+
                   |                                    |
      +------------------------+        +------------------------+
      | Prismatic Perimeter    |        | Prismatic Perimeter    |
      | Core                   |        | Web                    |
      | (Business Logic)       |        | (LiveView Dashboard)   |
      +------------------------+        +------------------------+
              |       |                         |
      +-------+-------+-------+         +------+------+
      |       |       |       |         | Phoenix     |
      | Score | Compl | Risk  |         | LiveView    |
      | Engine| iance | Model |         | Components  |
      +-------+-------+-------+         +-------------+
              |
      +-------+--------+--------+--------+
      | Shodan | Censys | crt.sh | ARES   | ...121+ sources
      +--------+--------+--------+--------+

The facade module PrismaticPerimeter provides the public API, delegating to PrismaticPerimeterCore for computation and PrismaticPerimeterWeb for presentation. This separation allows the scoring engine to be invoked from the REST API, CLI, or agent system without loading web dependencies.

2.2 Core Components

2.3 Process Topology

PrismaticPerimeter.Application (Supervisor, :one_for_one)
+-- PrismaticPerimeterCore.ScoreEngine (GenServer)
|     Maintains score computation state, caches recent computations
+-- PrismaticPerimeterCore.AssetDiscovery.Scheduler (GenServer)
|     Schedules periodic discovery sweeps per monitored entity
+-- PrismaticPerimeterCore.ComplianceEngine (GenServer)
|     Manages compliance framework rule sets and assessment state
+-- PrismaticPerimeterCore.Benchmarker (GenServer)
|     Computes and caches industry percentile data
+-- PrismaticPerimeterCore.ChangeDetector (GenServer)
|     Monitors asset state changes between discovery cycles
+-- Task.Supervisor
      Supervises concurrent OSINT query tasks during discovery

All GenServers follow the :one_for_one restart strategy. The Task.Supervisor isolates concurrent OSINT queries so that a single source timeout does not cascade to other queries.

2.4 Data Flow

Entity (domain) --> AssetDiscovery.Scheduler
                         |
                    [Parallel OSINT Queries]
                    |    |    |    |    |
                Shodan Censys crt.sh DNS WHOIS ...
                    |    |    |    |    |
                    +----+----+----+----+
                         |
                    Evidence Aggregation
                         |
                  +------+------+
                  |             |
             ScoreEngine  ComplianceEngine
                  |             |
             SecurityRating  ComplianceReport
                  |             |
              GradeMapper   RiskModel
                  |             |
              Benchmarker  ChangeDetector
                  |             |
              Dashboard    Alert System

3. Implementation

3.1 Key Algorithms

Security Score Computation. The scoring algorithm evaluates 12 security dimensions, each producing a sub-score on a 0-100 scale. Sub-scores are weighted by risk significance and aggregated into a composite score mapped to the 300-900 range:

• DNS security (DNSSEC, CAA records, SPF/DKIM/DMARC)
• TLS configuration (protocol version, cipher strength, certificate validity)
• HTTP security headers (HSTS, CSP, X-Frame-Options)
• Open port exposure (unnecessary services, high-risk ports)
• Vulnerability presence (CVEs on detected services)
• Email security (SPF, DKIM, DMARC alignment)
• Web application security (known CMS vulnerabilities, WAF presence)
• Patching cadence (time from CVE disclosure to remediation)
• Information leakage (exposed admin panels, directory listings)
• Cloud configuration (S3 bucket exposure, metadata services)
• Reputation data (presence on blocklists, abuse reports)
• Certificate management (expiry proximity, chain completeness)

Grade Mapping. Numeric scores map to letter grades via configurable thresholds: A (810-900), B (720-809), C (630-719), D (540-629), F (300-539).

3.2 Data Structures

defmodule PrismaticPerimeterCore.SecurityRating do
  @type t :: %__MODULE__{
    entity: String.t(),
    score: 300..900,
    grade: :A | :B | :C | :D | :F,
    industry_percentile: 0..100,
    dimensions: %{atom() => dimension_score()},
    evidence: [Evidence.t()],
    confidence: float(),
    computed_at: DateTime.t(),
    trend: :improving | :stable | :declining
  }

  defstruct [:entity, :score, :grade, :industry_percentile,
             :dimensions, :evidence, :confidence, :computed_at, :trend]
end

3.3 API Surface

# Discover external attack surface for a domain
@spec discover(String.t(), keyword()) :: {:ok, AttackSurface.t()} | {:error, term()}
PrismaticPerimeter.discover("example.com", depth: :full)
# => {:ok, %AttackSurface{
#   domains: ["example.com", "www.example.com", "api.example.com"],
#   ip_addresses: ["93.184.216.34"],
#   certificates: [%Certificate{subject: "*.example.com", expires: ~U[2026-06-15]}],
#   services: [%Service{port: 443, protocol: :https, version: "nginx/1.25"}],
#   technologies: ["nginx", "Let's Encrypt"],
#   discovery_time_ms: 4_520
# }}

# Compute security rating
@spec security_rating(String.t(), keyword()) :: {:ok, SecurityRating.t()} | {:error, term()}
PrismaticPerimeter.security_rating("example.com")
# => {:ok, %SecurityRating{
#   score: 780, grade: :B, industry_percentile: 72,
#   dimensions: %{tls: 95, dns: 82, headers: 70, ports: 88, ...},
#   confidence: 0.91, trend: :improving
# }}

# Assess compliance against regulatory frameworks
@spec assess_compliance(String.t(), [atom()]) :: {:ok, ComplianceAssessment.t()} | {:error, term()}
PrismaticPerimeter.assess_compliance("example.com", [:nis2, :zkb])
# => {:ok, %ComplianceAssessment{
#   frameworks: %{
#     nis2: %{score: 72, status: :partially_compliant, controls: 42},
#     zkb: %{score: 68, status: :partially_compliant, controls: 38}
#   },
#   remediation_items: [...],
#   evidence_count: 156
# }}

3.4 Configuration

config :prismatic_perimeter,
  # Score computation
  grade_thresholds: %{A: 810, B: 720, C: 630, D: 540},
  dimension_weights: %{
    tls: 1.2, dns: 1.0, headers: 0.8, ports: 1.1,
    vulnerabilities: 1.5, email: 0.7, patching: 1.3,
    leakage: 0.9, cloud: 1.0, reputation: 0.8, certificates: 0.9
  },

  # Discovery configuration
  discovery_sources: [:shodan, :censys, :crtsh, :dns, :whois, :securitytrails],
  discovery_timeout: 30_000,
  max_concurrent_sources: 10,

  # Monitoring
  monitoring_interval: :timer.hours(6),
  change_notification_threshold: :medium

4. Integration

4.1 Dependencies

4.2 Dependents

4.3 Inter-Process Communication

The Perimeter subsystem communicates with other applications via Phoenix PubSub for event broadcasting, direct GenServer calls for synchronous queries, and ETS for shared cached state. Discovery results are broadcast on the "perimeter:discovery" PubSub topic. Rating changes are broadcast on "perimeter:rating_change".

4.4 External Integrations

The system queries 121+ external OSINT sources through the Prismatic OSINT Core adapter layer. Key external services include Shodan (host intelligence), Censys (certificate and host data), crt.sh (certificate transparency), SecurityTrails (DNS history), VirusTotal (reputation), and AbuseIPDB (IP reputation). All external calls pass through Prismatic Resilience circuit breakers and Prismatic Cache for fault tolerance and cost optimization.

5. Performance

5.1 Benchmarks

5.2 Scalability

Discovery workloads scale horizontally through Task.Supervisor fan-out. Each monitored entity runs an independent discovery pipeline, limited only by OSINT source rate limits and available process slots. The scoring engine is CPU-bound and scales vertically with additional cores. Dashboard connections scale through Phoenix PubSub, which supports millions of concurrent WebSocket connections.

5.3 Resource Requirements

6. Testing Strategy

6.1 Unit Tests

Each scoring dimension has dedicated unit tests verifying score computation from known evidence inputs. Grade mapping tests cover boundary conditions at every threshold. Compliance control tests verify correct pass/fail/partial assessment for each NIS2 and ZKB control.

6.2 Integration Tests

Cross-application tests verify the full pipeline from OSINT source query through evidence aggregation, score computation, and dashboard rendering. Mock OSINT responses are used for deterministic testing while preserving the full processing pipeline.

6.3 Property-Based Testing

StreamData generators produce random evidence sets to verify scoring algorithm invariants: scores always fall within 300-900, grades are monotonically ordered, and confidence scores decrease appropriately when evidence is sparse.

7. Security Considerations

7.1 Threat Model

The primary threat is manipulation of external evidence to inflate or deflate security ratings. Mitigations include multi-source corroboration (NABLA Signal Plurality axiom), temporal consistency checks, and anomaly detection on sudden score changes. Rating computation is deterministic from evidence, preventing operator manipulation.

7.2 Access Control

Dashboard access requires authentication through Prismatic Auth with the perimeter_read permission. Discovery operations require perimeter_scan. API access requires a valid API key with appropriate permissions. All access is logged to the Prismatic Audit trail.

8. Operational Considerations

8.1 Deployment

The Perimeter subsystem deploys as part of the Prismatic umbrella release. The web dashboard is served on port 4003. Discovery scheduling begins automatically on application start. No manual configuration is required beyond OSINT API credentials.

8.2 Monitoring

Telemetry events are emitted for discovery operations ([:prismatic, :perimeter, :discovery]), rating computations ([:prismatic, :perimeter, :rating]), and compliance assessments ([:prismatic, :perimeter, :compliance]). Key metrics include discovery latency, source availability, score distribution, and compliance coverage.

8.3 Troubleshooting

9. Future Work

Planned enhancements include active scanning capabilities (with opt-in authorization), historical rating comparison across organizations, automated remediation recommendations with effort estimates, integration with vulnerability management platforms for patching feedback loops, and expansion of compliance frameworks to include ISO 27001 and SOC 2.

References

• Prismatic Perimeter Core -- Business logic module
• Prismatic Perimeter Web -- LiveView dashboard
• Prismatic Compliance -- NIS2/ZKB framework definitions
• Prismatic OSINT Core -- Intelligence source layer
• NIS2 Directive (EU 2022/2555) -- EU cybersecurity directive
• ZKB 264/2025 Sb. -- Czech cybersecurity act
• BitSight -- Competitive reference: security ratings
• SecurityScorecard -- Competitive reference: security ratings

Related Agents

• CER Compliance Commander -- Drives NIS2 Directive and ZKB compliance assessment with article-level regulatory mapping
• Competitor Researcher -- Provides competitive positioning analysis against BitSight, Black Kite, and SecurityScorecard
• GitLab Security Specialist Agent -- Integrates security findings from CI/CD pipelines into attack surface monitoring

Related Capabilities

• Real-Time Monitoring -- Continuous OSINT source polling with change detection for attack surface surveillance
• Intelligence Synthesis -- Evidence-based security ratings from 121+ OSINT sources with multi-factor scoring
• NABLA Axioms -- Ratings grounded in epistemic axioms with provenance tracing and confidence scoring

Connect & Contribute

Created by Tomáš Korcak (korczis) | Open Source under GHL

• GitHub | GitLab | LinkedIn | Contact
• Developer Portal | Architecture | Meet the Creator