CRAG – Cognitive Resilience and Automated Governance
GitHubAI-powered third-party vendor risk monitoring prototype with real-time risk scoring.
Overview
CRAG is a prototype built to shift third-party vendor risk management from a static, annual compliance checkbox into a dynamic, real-time monitoring system powered by AI scoring.
The Problem
Organizations struggle to monitor vendor risks in real-time, often relying on manual periodic surveys that fail to capture immediate threat posture changes.
System Architecture
React frontend communicating with a FastAPI Python backend. Scheduled tasks (APScheduler) continuously recalculate risk scores based on incoming telemetry and survey updates.
Engineering Trade-offs
Opted for polling over WebSockets for dashboard updates to simplify backend state management, accepting a 60-second delay in score propagation.
Lessons Learned & Future
Production Learnings
Complex scoring algorithms are difficult to debug when state changes frequently. Building a 'score history' table was crucial for auditability.
Future Improvements
Integrating external threat intelligence feeds (like OSINT or CVE databases) to automatically adjust vendor scores based on zero-day vulnerabilities.
Database Layer
PostgreSQL (via SQLAlchemy) for relational mappings of vendors to risk domains. Firebase Auth for identity management.
API Design
RESTful endpoints for vendor data ingestion. Internal cron jobs orchestrate the scoring algorithms rather than relying on request-time computation.
Security Decisions
1. Enforced strict JWT validation with Role-Based Access Control to ensure vendors can only view their own scores. 2. All compliance logs are append-only to prevent tampering.
Scale & Metrics
Capable of recalculating risk scores for 1,000 simulated vendors in under 2 seconds.