A modern, decoupled stack built for speed, extensibility, and real-time threat intelligence.
The risk engine uses an extensible, object-oriented rule system. Each threat type (brute force, privilege escalation, impossible travel, data exfiltration, etc.) is implemented as an independent RiskRule class that evaluates events and returns weighted impact scores. Rules are dynamically registered, making the engine fully pluggable.
The aggregated score (0–100) maps to severity bands: Low (0–24), Medium (25–49), High (50–74), Critical (75–100).