Command
Security Command Centre
One view across AFC OS, the GRC Platform, Client Portals, the Whistleblower Portal, the public website and the goAML API bridge
Security posture
78 / 100
+3 vs September
Threat level
Elevated
phishing wave targeting RO staff
Open incidents
7
Sev 2: 2 · Sev 3: 5
Blocked today
2,148,730
geo 41% · reputation 33% · WAF 26%
MTTD / MTTR
6 m / 47 m
targets 10 m / 4 h
Phishing-resistant MFA
91%
passkeys and FIDO2 keys
Devices compliant
96.2%
57 drifted · 54 repaired
Critical past SLA
3
1 listed in CISA KEV
Live threat map
Requests to every dooit platform · last 15 minutes · arcs are blocked or challenged sources heading for the Dhaka data centre
Loading world map…
Blocked sourceChallenged sourceSuspiciousDhaka data centre
Posture by function
NIST CSF 2.0 · coverage × effectiveness × evidence freshness
78
of 100
Govern
74
Identify
81
Protect
83
Detect
79
Respond
72
Recover
66
AI briefing · root causes behind today’s alerts
412 edge alerts trace to one firewall object
Fix proposedA stale address group lets two hosting networks reach the GRC admin API. Tightening FW-118 removes 61% of today’s edge alerts.
correlation agent · confidence 0.93
MFA fatigue against 4 RO compliance officers
ContainedPush bombing from residential proxies. Number matching enforced and the sessions revoked.
identity threat detection
Signing key used outside its window
Benigngoaml-sign-2026 used at 02:14 by svc-goaml. The pattern matches the batch job moved last week.
behaviour model · z = 3.4
VPN appliance flaw listed in CISA KEV
DueEPSS 0.94. Ring 0 is patched; ring 1 is due in 18 hours.
priority 92 · SLA 72 h
Platform protection
Every platform sits behind the same edge, identity, key and logging services
| Platform | Edge | WAF | Sign-in | Geo rule | Posture | Last test |
|---|---|---|---|---|---|---|
| AFC OS | Enforced | CRS PL3 | Passkey only | Bangladesh only | 84 | Aug 2026 |
| GRC Platform | Enforced | CRS PL2 | Passkey + adaptive | Bangladesh · others challenged | 81 | Jul 2026 |
| Client Portal | Enforced | CRS PL2 | Adaptive MFA | Bangladesh · 4 blocked | 76 | Sep 2026 |
| Whistleblower Portal | Privacy mode | CRS PL2 | Anonymous | Exempt by design | 88 | Jun 2026 |
| Public website | Enforced | CRS PL1 | — | Global · 1 blocked | 90 | May 2026 |
| Public API · goAML bridge | Enforced | Schema + mTLS | mTLS + OAuth 2.0 | Bangladesh only | 79 | Sep 2026 |
Live security events
Top cyber risks · residual score
Compromise of RO user credentials
82
Ransomware on case-management servers
64
Insider misuse of STR data
58
Payment-message manipulation (SWIFT)
51
DDoS on the Whistleblower Portal
44
Harvest-now, decrypt-later
38
Security programme lifecycle
NIST CSF 2.0 · this quarter’s focus is Detect · each step opens its page
✓CISO office
Govern
Risk appetite, roles, policy and board reporting
✓Security engineering
Identify
Assets, data, suppliers and risk
✓Security engineering
Protect
Identity, devices, data, keys and the edge
4SOC
Detect
Continuous monitoring with AI triage
5Incident commander
Respond
Contain, eradicate, communicate
6IT operations
Recover
Restore services and confirm integrity
7CISO office
Improve
Lessons learned feed the roadmap