Exposure Control turns fragmented security signals into normalized exposure records, business context, explainable policy, accountable remediation, owner and team routing, and evidence-based closure.
This entirely fictional banking environment supports the architecture with realistic applications, assets, teams, ownership gaps, source quality issues, and scale without using employer, customer, production, or real bank data.
100
Applications
1,000
Assets
20
Engineering teams
~10,000
Correlated exposures
Validated synthetic scale model; not a production benchmark. The dashboard makes all 10,000 sanitized records filterable and keeps 12 representative cases for readable detail.
THE CONTROL PATH
One visible chain from source signal to enterprise decision.
A source finding is normalized, enriched with business context, evaluated through policy, routed to an accountable owner, tracked through remediation, and only closes when current validation confirms the exposure changed. A failed gate returns the work.
Swipe to follow all five stages →
DEMONSTRATION BOUNDARY
Atlas Meridian is the fictional enterprise proving ground for this model. It is synthetic, non-production, and not real bank data or customer telemetry.
PRODUCTION BOUNDARY
A real deployment requires separately permissioned identities, authoritative scanner retests, operating controls, and measured reliability.
WHAT I BUILT
Architecture carried through to working controls.
I designed the lifecycle and implemented the vertical slice: schemas, scoring, replaceable adapters, ownership resolution, remediation routing, persistence, a GitHub Issues adapter, validation gates, tests, and deployment references.
01 / MODELCanonical schemas and workflow invariants
02 / DECIDEDeterministic contextual risk and a versioned remediation-priority policy
03 / ACTOwnership resolution, remediation routing, and an idempotent GitHub Issues adapter
04 / STORESQLite persistence and a PostgreSQL adapter with forced tenant row-level-security policies
05 / ASSURETests, scanners, workflow permissions, and deployment references
WORKING TODAY
Runnable portfolio MVP
Local-only CSV ingestion, deterministic risk scoring, accountable routing, a GitHub Issues adapter, two persistence adapters, repository scanners, a dashboard, and a safe lifecycle demo.
PRODUCTION EXTENSION
Authoritative sources and operations
IAM, EDR, CSPM, CMDB, Jira, and ServiceNow integrations are extension points for production integration. Production also needs recovery, security, reliability, and scale controls.
ROUTING CONTROL
No silent assignment
Asset-to-application and application-to-team context resolve ownership. Missing, stale, or conflicting ownership is held for governance review and escalation instead of being routed silently.
Atlas Meridian is a fictional, non-production enterprise context used to reason about applications, assets, teams, owners, source quality, and decision routing.
Exposure Control demonstrates Alfe Corona’s approach to cybersecurity architecture, secure automation, cloud security engineering, and clear communication across security, engineering, and risk stakeholders.
Designed and built byAlfe CoronaSecurity architecture · engineering · executive risk communication
