Decisions under uncertainty.
Without guessing.
Open-source platform for due diligence, M&A risk, OSINT and CER/NIS2 compliance. 552 autonomous agents, 228 commands, 92 umbrella apps. Evidence in. Hypotheses compete. Scores computed deterministically. Every recommendation traceable to source.
Real cases.
Real evidence.
Live dashboards.
Each Due Diligence case is a self-contained interactive workspace with knowledge graph (force-directed, betweenness centrality, shortest-path queries), risk matrix, evidence chains, and ready-to-use comms templates.
Jiří Koc — Background Investigation
Risk CJiří Koc — Background Investigation
Comprehensive background check. 5 candidate identities under disambiguation review (strongest match: Antonín Koc, 1975, Stavby Koc s.r.o.).
Petr Novák — Enhanced Pipeline Demo
Risk BPetr Novák
Pipeline showcase: 8 OSINT sources, 7 completed (mostly clean), 1 CUZK CAPTCHA-blocked. Demo/templated data — not a real investigation.
Procházka & Co. — Brno (Generalista, ZZVZ)
Risk BProcházka & Co., advokátní kancelář, s.r.o.
Posouzení potenciálního právního zástupce. 8+4 tým, ~80 % portfolia z SMB skupiny města (KCR signál), generalistický profil, 5/10 specializační hloubka, 8/10 finanční stabilita. 193-uzlová síťová mapa s 235 hranami a betweenness centralitou.
Platform at a glance.
A production-grade decision engine, not a slide deck. Every number measurable via mix prismatic.stats.
Three nested layers. Composable. Replaceable.
Data · Logic · Presentation. Each layer is an independent OTP application contract. Hot-loadable, hot-swappable, individually testable.
Hot-loadable · Independently scalable · Contract-tested adapters
Decisions without evidence are liabilities.
Boards demand quantified cyber risk. Regulators demand audit trails. Insurers demand evidence. Most organizations still rely on spreadsheets, vendor questionnaires, and opaque third-party scores that collapse under regulatory scrutiny.
Financial Exposure
Average data breach costs EUR 4.45M. Regulatory fines under NIS2 reach 2% of global revenue. Unquantified risk means unmanaged capital exposure.
Reputational Damage
Supplier breaches cascade. A single compromised vendor can expose your entire customer base. Reactive monitoring is too slow.
Regulatory Pressure
NIS2 requires evidence-based risk assessment, not vendor questionnaires. Regulators reject scores without traceable methodology.
Structured risk quantification,
not aggregated opinions.
Every score is traceable to source evidence. Every anomaly is explainable. Every assessment is audit-ready.
Pipeline-Based Inference
Signals flow through a deterministic scoring pipeline. No black-box models. Every risk factor maps to a specific evidence chain with provenance timestamps.
Behavioral Anomaly Detection
Statistical baseline comparison using Kolmogorov-Smirnov tests. Detects drift in supplier security posture, configuration changes, and certificate anomalies before they become incidents.
Audit-Ready Evidence
Every score links to timestamped, source-attributed evidence. Regulators can trace any risk factor from board report to raw signal. Full provenance chain, no black boxes.
Governance-First Architecture
Built for regulated industries. Workspace isolation ensures data separation between entities. Role-based access, immutable audit logs, and automated compliance reporting from day one.
Workspace Isolation
Multi-tenant by design. Each client workspace has isolated data, separate scoring contexts, and independent audit trails. No cross-contamination between assessments.
Explainable Risk Outputs
Scores decompose into human-readable factors. Board members see letter grades. Analysts see contributing signals. Auditors see evidence chains. Same data, three views.
From 128+ signal sources
to one board slide.
Prismatic ingests intelligence from domain records, certificate transparency logs, breach databases, public registries, plus 34 Czech-specific and 14 EU sources. The scoring engine distills this into a single composite rating with drill-down capability to any contributing factor.
Numeric scores (300-900) with letter grade mapping. Industry percentile benchmarking.
Real-time alerting on attack surface changes, certificate expirations, compliance drift.
Automated NIS2 Article mapping, ZKB 264/2025 Sb. gap analysis, evidence export.
How Prismatic compares.
Incumbents produce scores. Prismatic produces evidence-backed risk quantification.
| Capability | BitSight / SecurityScorecard | Prismatic |
|---|---|---|
| Score methodology transparency | Proprietary, opaque | Open, auditable |
| Evidence chain to raw signal | Partial | Complete provenance |
| Behavioral anomaly detection | No | KS-test baselines |
| NIS2 compliance mapping | Add-on module | Built-in, article-level |
| Workspace isolation | Shared tenant | Full isolation |
| Typical ACV | EUR 80-250K | EUR 40-120K |
| Capability | Black Kite / RiskRecon | Prismatic |
|---|---|---|
| Risk quantification methodology | Aggregated signals | Structured scoring pipeline |
| Supplier behavioral monitoring | Periodic snapshot | Continuous, drift-aware |
| Czech/CEE registry integration | None | 34 Czech + 14 EU sources |
| Due diligence automation | Separate product | Integrated pipeline |
| Deployment model | SaaS only | SaaS, on-prem, air-gapped |
| Capability | Credo AI / Holistic AI | Prismatic |
|---|---|---|
| AI decision drift monitoring | Model-specific | Cross-system behavioral |
| External risk integration | None | 128+ OSINT sources |
| Epistemic rigor framework | Best-effort | Formally verified (Lean4) |
| Compliance scope | AI-specific regulations | AI + cyber + governance |
| Board-level reporting | Technical dashboards | CFO-grade risk outputs |
Board-level outcomes.
Quantified impact across financial, operational, and regulatory dimensions.
Built for regulated enterprises
managing external risk.
Prismatic serves organizations where cyber risk has board visibility, supplier ecosystems create material exposure, and regulatory compliance requires evidence-based assessment.
Common Trigger Events
Company Profile
Industries
Budget Holders
Behavioral Risk Intelligence
Behavioral Risk Intelligence is the practice of continuously quantifying organizational risk exposure through structured analysis of external signals, supplier behavior patterns, and regulatory compliance posture. Unlike traditional security ratings that produce static scores, BRI systems maintain audit-ready evidence chains, detect behavioral drift in third-party ecosystems, and generate explainable risk outputs suitable for board-level decision-making and regulatory submission.
Prismatic defines and leads this category by combining external attack surface management, OSINT-powered due diligence, and AI drift monitoring into a single governance-first platform with deterministic, evidence-backed scoring.
Shipping evidence, not roadmaps.
Public milestones from the platform's continuous evolution. No marketing dates — every entry traceable to a commit.
Built on fault-tolerant infrastructure.
Elixir/OTP runtime provides fault isolation, hot code reloading, and sub-millisecond process spawning. No single-point-of-failure architecture. Designed for continuous operation in regulated environments.
External Risk Assessment
Smallest viable entry: score your external attack surface and top 20 suppliers. Audit-ready report delivered in 48 hours. No integration required.
- Attack surface discovery
- Security rating (A-F) with evidence
- NIS2 gap analysis
- Board-ready PDF report
Continuous Risk Intelligence
Full platform deployment: continuous monitoring, supplier ecosystem scoring, behavioral anomaly detection, and automated compliance reporting.
- Unlimited supplier monitoring
- Real-time drift detection
- Due diligence automation
- API access + workspace isolation