Synthetic Risk Cases

Gap Library

A small collection of synthetic control gaps, modelled on the kinds of issues Brontë would surface in production. Pick one to see the agent diagnose it, plan the remediation, and ship the work.

Identity & Access

Critical

MFA enforcement gap on privileged admin accounts

CTRL-IAM-047

Three production administrator accounts in the central identity provider remain exempt from mandatory MFA policy despite having standing access to customer, treasury, and identity administration consoles.

Open with Agent

Data Protection

High

Encryption-at-rest gap on general ledger replica

CTRL-DP-112

A non-production replica of the general ledger PostgreSQL cluster was restored into the analytics VPC without storage-level encryption, leaving financial records exposed if the underlying volume is accessed outside the application layer.

Open with Agent

Change Management

High

Change approval bypass in deployment pipeline

CTRL-CHG-031

Seven production deployments in the last quarter were merged and released through the automated pipeline without the required second-engineer approval because the branch protection rule was disabled for the release service account.

Open with Agent

Transaction Monitoring

Critical

Sanctions screening lag on cross-border payments

CTRL-TM-204

Sanctions-list updates are taking up to 36 hours to propagate from the compliance feed handler into the cross-border payments screening engine, materially exceeding the required four-hour maximum and increasing exposure to prohibited counterparties.

Open with Agent

Vendor Risk

Medium

Vendor access review overdue for third-party support vendors

CTRL-VRM-019

Quarterly access recertification for four third-party support vendors has not been completed for two consecutive review cycles, leaving external production access active without current business-owner attestation.

Open with Agent

Change Management

Critical

Unreviewed LLM used in customer complaints triage

CTRL-MDL-014

The customer complaints triage service has been promoted to production using a third-party LLM endpoint with no model-risk sign-off, no human-review gate on outbound responses, and no evidence captured for regulator-facing decisions about hardship, fees, or dispute resolution.

Open with Agent

Data Protection

High

Audit log retention gap on payments service

CTRL-DP-188

Audit logs for the payments microservice are being purged after 30 days in the observability pipeline instead of the required 12 months, reducing the ability to investigate fraud events and meet card scheme evidence obligations.

Open with Agent